Method and system for inspecting unicast network traffic between end points residing within a same zone

ABSTRACT

A method and system for inspecting unicast network traffic between end points residing within a same zone. Specifically, the method and system disclosed herein entail the provisioning of unique forward-service and reverse-service virtual network identifiers (VNIs), and corresponding virtual layer-2 (VL2) forward-service and reverse-service broadcast domains, respectively, to communications originating from and destined to intercept hosts.

BACKGROUND

Typically, the insertion of a transparent service device in the networktraffic path between end points results in the segmentation of thelayer-2 domain into two zones. All end points in any given zone cancommunicate directly with one another while communication between endpoints in different zones traverses through the service device.

SUMMARY

In general, in one aspect, the invention relates to a method forprocessing network traffic. The method includes receiving, from a firstremote virtual tunnel end point (VTEP), a first virtual layer-3 (VL3)frame comprising a forward-service virtual network identifier (VNI),decapsulating the first VL3 frame to obtain a first unicast media accesscontrol (MAC) frame originating from a first source, wherein the firstunicast MAC frame comprises a forward-service virtual layer-2 (VL2)broadcast domain tag associated with a forward-service VL2 broadcastdomain, making a first determination, using a first destination MACaddress associated with a first destination, that the first destinationMAC address is known on the forward-service VNI, translating, based onthe first determination, the first unicast MAC frame into an originalVL2 broadcast domain, to obtain a second unicast MAC frame, andbridging, through a near network interface (NNI), the second unicast MACframe to a service device.

In general, in one aspect, the invention relates to a non-transitorycomputer readable medium (CRM). The non-transitory CRM includes computerreadable program code, which when executed by a computer processor,enables the computer processor to receive, from a first remote virtualtunnel end point (VTEP), a first virtual layer-3 (VL3) frame comprisinga forward-service virtual network identifier (VNI), decapsulate thefirst VL3 frame to obtain a first unicast media access control (MAC)frame originating from a first source, wherein the first unicast MACframe comprises a forward-service virtual layer-2 (VL2) broadcast domaintag associated with a forward-service VL2 broadcast domain, make a firstdetermination, using a first destination MAC address associated with afirst destination, that the first destination MAC address is known onthe forward-service VNI, translate, based on the first determination,the first unicast MAC frame into an original VL2 broadcast domain, toobtain a second unicast MAC frame, and bridge, through a near networkinterface (NNI), the second unicast MAC frame to a service device.

Other aspects of the invention will be apparent from the followingdescription and the appended claims.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 shows a system in accordance with one or more embodiments of theinvention.

FIG. 2 shows a tunneling diagram in accordance with one or moreembodiments of the invention.

FIGS. 3A-3C show flowcharts describing a method for sharingcontrol-plane information in accordance with one or more embodiments ofthe invention.

FIGS. 4A and 4B show flowcharts describing a method for receiving andprocessing control-plane information in accordance with one or moreembodiments of the invention.

FIGS. 5A and 5B show flowcharts describing a method for receiving andprocessing control-plane information in accordance with one or moreembodiments of the invention.

FIGS. 6A-6C show flowcharts describing a method for transmittingredirected unicast network traffic within a zone in accordance with oneor more embodiments of the invention.

FIGS. 7A-7C show flowcharts describing a method for receiving redirectedunicast network traffic within a zone in accordance with one or moreembodiments of the invention.

FIGS. 8A-8C show flowcharts describing a method for receiving redirectedunicast network traffic within a zone in accordance with one or moreembodiments of the invention.

FIGS. 9A-9C show flowcharts describing a method for transmittinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention.

FIG. 10A-10D show flowcharts describing a method for transmittinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention.

FIGS. 11A and 11B show flowcharts describing a method for transmittinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention.

FIG. 12 shows a flowchart describing a method for receiving inspectedunicast network traffic within a zone in accordance with one or moreembodiments of the invention.

FIGS. 13A-13C show flowcharts describing a method for receivinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention.

FIGS. 14A-14C show flowcharts describing a method for receivinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention.

FIGS. 15A-15C show flowcharts describing a method for transmittingredirected broadcast network traffic within a zone in accordance withone or more embodiments of the invention.

FIGS. 16A-16D shows a flowchart describing a method for receivingredirected broadcast network traffic within a zone in accordance withone or more embodiments of the invention.

FIGS. 17A and 17B show flowcharts describing a method for transmittinginspected broadcast network traffic within a zone in accordance with oneor more embodiments of the invention.

FIG. 18 shows a flowchart describing a method for transmitting inspectedbroadcast network traffic within a zone in accordance with one or moreembodiments of the invention.

FIGS. 19A and 19B show flowcharts describing a method for transmittingredirected unicast network traffic within a first zone in accordancewith one or more embodiments of the invention.

FIGS. 20A and 20B show flowcharts describing a method for receivingredirected unicast network traffic within a first zone in accordancewith one or more embodiments of the invention.

FIGS. 21A-21C show flowcharts describing a method for transmittinginspected unicast network traffic from a first zone to a second zone inaccordance with one or more embodiments of the invention.

FIGS. 22A and 22B show flowcharts describing a method for receivinginspected unicast network traffic within a second zone in accordancewith one or more embodiments of the invention.

FIGS. 23A-23C show flowcharts describing a method for transmittinginspected unicast network traffic within a second zone in accordancewith one or more embodiments of the invention.

FIGS. 24A-24C show flowcharts describing a method for deliveringinspected unicast network traffic within a second zone in accordancewith one or more embodiments of the invention.

DETAILED DESCRIPTION

Specific embodiments of the invention will now be described in detailwith reference to the accompanying figures. In the following detaileddescription of the embodiments of the invention, numerous specificdetails are set forth in order to provide a more thorough understandingof the invention. However, it will be apparent to one of ordinary skillin the art that the invention may be practiced without these specificdetails. In other instances, well-known features have not been describedin detail to avoid unnecessarily complicating the description.

In the following description of FIGS. 1-24C, any component describedwith regard to a figure, in various embodiments of the invention, may beequivalent to one or more like-named components described with regard toany other figure. For brevity, descriptions of these components will notbe repeated with regard to each figure. Thus, each and every embodimentof the components of each figure is incorporated by reference andassumed to be optionally present within every other figure having one ormore like-named components. Additionally, in accordance with variousembodiments of the invention, any description of the components of afigure is to be interpreted as an optional embodiment which may beimplemented in addition to, in conjunction with, or in place of theembodiments described with regard to a corresponding like-namedcomponent in any other figure.

Throughout the application, ordinal numbers (e.g., first, second, third,etc.) may be used as an adjective for an element (i.e., any noun in theapplication). The use of ordinal numbers is not to necessarily imply orcreate any particular ordering of the elements nor to limit any elementto being only a single element unless expressly disclosed, such as bythe use of the terms “before”, “after”, “single”, and other suchterminology. Rather, the use of ordinal numbers is to distinguishbetween the elements. By way of an example, a first element is distinctfrom a second element, and the first element may encompass more than oneelement and succeed (or precede) the second element in an ordering ofelements.

In general, embodiments of the invention relate to a method and systemfor inspecting unicast network traffic between end points residingwithin a same zone. Specifically, one or more embodiments of theinvention entails the provisioning of unique forward-service andreverse-service virtual network identifiers (VNIs), and correspondingvirtual layer-2 (VL2) forward-service and reverse-service broadcastdomains, respectively, to communications originating from and destinedto intercept hosts.

One or more embodiments of the invention hereinafter may be described inconjunction with virtual local area network (VLAN) layer-2 (L2)broadcast domains. However, one of ordinary skill will appreciate thatthe invention may be practiced using alternative virtual L2 (VL2)broadcast domains. Further, one or more embodiments of the inventionhereinafter may also be described in conjunction with the virtualextensible local area network (VXLAN) layer-3 (L3) encapsulation andtunneling protocol. However, one of ordinary skill will appreciate thatthe invention may be practiced using alternative virtual L3 (VL3)tunneling mechanisms. These other VL3 tunneling mechanisms may pertainto, for example, multi-protocol label switching (MPLS), generic routingencapsulation (GRE), and other existing or future developed tunnelingmechanisms.

FIG. 1 shows a system in accordance with one or more embodiments of theinvention. The system (100) may include multiple network elements(106A-106N) operatively connected to one another and at least onecontrol-plane service (CPS) (112) through a layer-3 (L3) fabric (110).The system (100) may further include multiple hosts (102A-102N), whichmay be directly-connected to one or more of the network elements(106A-106N). Furthermore, on each network element (106A-106N), arespective virtual tunnel end point (VTEP) (108A-108N) may be executingthereon. Moreover, the system (100) may include at least one servicedevice (104), which may be directly-connected to at least one networkelement (e.g., 106N), respectively. Additionally, the system (100) mayinclude an original virtual layer-2 (VL2) broadcast domain (114)employed by at least the one or more hosts (102A-102N) and the at leastone service device (104). Each of these components is described below.

In one embodiment of the invention, a network element (106A-106N) may bea physical device that includes persistent storage, memory (e.g., randomaccess memory (RAM), shared memory, etc.), one or more computerprocessors (e.g., integrated circuits) (including a switch chip ornetwork processor), and two or more physical network interfaces orports. The computer processor(s) may be programmed to determine out ofwhich network interface on the network element (106A-106N) to forwardnetwork traffic (e.g., media access control (MAC) frames). To that end,the computer processor(s) may include logical egress and ingress networkinterfaces that may connect to physical network interfaces on thenetwork element (106A-106N). Further, each physical network interfacemay or may not be connected to another component (e.g., a host(102A-102N), another network element (106A-106N), a service device(104), or the L3 fabric (110)) in the system (100).

In one embodiment of the invention, a network element (106A-106N) mayinclude functionality to receive network traffic via the networkinterfaces, and determine whether to: (i) drop the network traffic; (ii)process the network traffic in accordance with one or more embodimentsof the invention; and/or (iii) send the network traffic, based on theprocessing, out another network interface on the network element(106A-106N) towards a destination.

How the network element (106A-106N) makes the determination of whetherto drop network traffic (e.g., network packets), and/or send networktraffic to another component in the system (100), depends, in part, onwhether the network element (106A-106N) is a L2 switch or a L3 switch(also referred to as a multilayer switch), which may perform at leastsome functions of a router. If the network element (106A-106N) isoperating as a L2 switch, the network element (106A-106N) uses thedestination MAC address along with a forwarding table or policy todetermine out of which network interface to send the network traffic. Ifthe network element (106A-106N) is operating as a L3 switch, the networkelement (106A-106N) uses the destination Internet Protocol (IP) addressalong with a routing table or policy to determine out of which networkinterface to send the network traffic, and includes the ability to writethe MAC address of the next stop (or component) to receive the networktraffic in place of its own MAC address (which the last hop or componentto send the network traffic wrote) in the L2 information encapsulatingthe network traffic. If the network element (106A-106N) is a multilayerswitch, the network element (106A-106N) includes functionality toprocess network traffic using both MAC addresses and IP addresses.

In one embodiment of the invention, the persistent storage on a networkelement (106A-106N) may include any type of non-transitory computerreadable medium that includes instructions, which when executed by thecomputer processor(s), enable the network element (106A-106N) to performany of the functionalities described herein. Moreover, examples of anetwork element (106A-106N) include, but are not limited to, a switch, arouter, and a multilayer switch. Further, a network element (106A-106N)is not limited to the aforementioned specific examples.

In one embodiment of the invention, a network element (106A-106N) mayinclude a virtual tunnel end point (VTEP) (108A-108N). A VTEP(108A-108N) may refer to a logical intelligence (i.e., software) taskedwith originating and/or terminating virtual layer-3 (VL3) tunnels.Further, a VTEP (108A-108N) may include functionality to: (i)encapsulate MAC frames into VL3 frames, where the MAC frames may begenerated by or obtained from a directly-connected host (102A-102N), avirtual machine (VM) (not shown) executing on a directly-connected host(102A-102N), and a directly-connected service device (104); (ii)transmit VL3 frames towards remote VTEPs (108A-108N) executing on remotenetwork elements (106A-106N) through the L3 fabric (110); (iii) receiveother VL3 frames from these remote VTEPs (108A-108N) via the L3 fabric(110); and (iv) decapsulate (i.e., remove the VL3 frame headerinformation from) these other VL3 frames to obtain other MAC framestherefrom, where these other MAC frames may have been generated byremote hosts (102A-102N), remote VMs executing on remote hosts(102A-102N), and remote service devices (104). By way of an example, aVL3 frame may be a virtual extensible local area network (VXLAN) frame,whereas the virtual tunnel through which VXLAN frames traverse may be aVXLAN tunnel. Embodiments of the invention are not limited to anyspecific implementation or protocol for generating VL3 frames and/orvirtual tunnels.

In one embodiment of the invention, a service VTEP may be describedherein. A service VTEP (e.g., VTEP N (108N)) may refer to a VTEP thatexecutes on a network element (e.g., network element N (106N)) that isdirectly-connected to a service device (104). Further, in one embodimentof the invention, a service network element may also be describedherein. A service network element (e.g., network element N (106N)) mayrefer to a network element that is directly-connected to a servicedevice (104).

In one embodiment of the invention, the original VL2 broadcast domain(114) may be defined as the set of computing devices (e.g., hosts(102A-102N), virtual machines (not shown), and service devices (104))that communicate with one another using the same virtual networkidentifier (VNI) (e.g., an original VNI), where the VNI is defined by,for example, the VXLAN protocol. Further, a VNI identifies the scope ofthe MAC frame originated by a computing device such that the MAC framemay only be sent to another computing device associated with the sameVNI. In one embodiment of the invention, a MAC frame may be sent to acomputing device associated with a different VNI when the MAC frame isrouted into a new VL2 broadcast domain (not shown). By way of examples,the original VL2 broadcast domain (114) may be implemented as a virtuallocal area network (VLAN) domain and/or a VXLAN domain. Embodiments ofthe invention are not limited to these specific examples.

In one embodiment of the invention, a host (102A-102N) may be anycomputing system (e.g., implemented through software and computerhardware) that may be configured to generate, send, receive, and/orprocess requests and replies, either locally or over a network. A host(102A-102N) may include one or more computer processors, memory, and oneor more physical network interfaces. Further, a host (102A-102N) mayinclude functionality to generate, receive, and/or transmit networktraffic (e.g., MAC frames). Examples of a host (102A-102N) include, butare not limited to, a server (e.g., a database server, a dynamic hostconfiguration protocol (DHCP) server, an application server, a fileserver, a print server, a mail server, or any other server), a desktopcomputer, a mobile device (e.g., a laptop computer, a smartphone, apersonal digital assistant (PDA), a tablet computer, or any other mobiledevice), or any other type of computing device including theaforementioned minimum requirements.

In one embodiment of the invention, there may be various types of hosts(102A-102N) described herein. For example, an intercept host may bementioned. In one embodiment of the invention, an intercept host mayrefer to a host whose outbound (i.e., generated) and/or inbound (i.e.,received) network traffic may be, or may have been, intercepted andinspected by a service device (104). The aforementioned network traffic,originating from and/or addressed to the intercept host, may beintercepted based on one or more service policies, rules, and/orredirect criteria (described below) programmed into various networkelements (106A-106N). By way of another example, a non-intercept hostmay also be mentioned herein. In one embodiment of the invention, anon-intercept host may refer to a host whose outbound (i.e., generated)and/or inbound (i.e., received) network traffic may not be sought forinterception and/or inspection by a service device (104). Though notrequired to be redirected to a service device (104), network trafficoriginating and/or addressed to a non-intercept host may still traversea service device (104) while being routed towards a destination, whereasthe network traffic itself may pass through without subjection to aservice function (applied by a service device (104)).

In one embodiment of the invention, a control-plane service (CPS) (112)may be a platform for the centralized management of and/or consolidationof state information for all or a portion of the network elements(106A-106N) in the system (100). A CPS (112) may be implemented as oneor more physical or virtual devices, which includes at least one or moreprocessors, memory, one or more physical network interfaces, and a datarepository. In one embodiment of the invention, a CPS (112) may includeexecutable instructions (stored in a non-transitory computer readablemedium), which when executed, enable the CPS (112) to disseminate, tovarious VTEPs (108A-108N), information pertinent to embodiments of theinvention disclosed herein (described below) (see e.g., FIGS. 3A-3D).

In one embodiment of the invention, a CPS (112) may include a datarepository (not shown). The data repository may be a storage system ormedia for consolidating various forms of data. The data repository maybe implemented across one or more physical and/or virtual storage unitsor devices, which may or may not be of the same type or co-located in asame computing device. Furthermore, the information consolidated in thedata repository may be arranged using any storage mechanism (e.g., afilesystem, a database, a collection of tables, etc.). In one embodimentof the invention, the data repository may be implemented usingpersistent (i.e., non-volatile) storage media. Examples of persistentstorage media include, but are not limited to: optical storage, magneticstorage, NAND Flash Memory, NOR Flash Memory, Magnetic Random AccessMemory (M-RAM), Spin Torque Magnetic RAM (ST-MRAM), Phase Change Memory(PCM), or any other storage media defined as non-volatile Storage ClassMemory (SCM).

In one embodiment of the invention, a service device (104) may be aphysical or virtual computing device that includes functionality toprovide a service to one or more network elements (106A-106N) and/or oneor more hosts (102A-102N). A service device (104) may include at leastone or more processors, memory, and two or more physical networkinterfaces. In one embodiment of the invention, a service device (104)may include functionality to process network traffic, redirected theretofrom various VTEPs (108A-108N), in accordance with the configuration of,and the specific service thus provided by, the service device (104).Subsequently, a service device (104) may include functionality tofilter, mirror, store, forward, drop, transform, and/or perform anyother action, or any combination thereof, to redirected network traffic,which is afforded by the configuration and provided service of theservice device (104). Examples of service devices (104) include, but arenot limited to, network security devices (e.g., firewall devices anddenial of service (DOS) attack scrubbers), network filtering devices(e.g., web content filters), network data caches (e.g., web-cachedevices), and network load balancing devices.

In one embodiment of the invention, the L3 fabric (110) may be a set ofinterconnected network elements or systems, which operatively connectone or more CPSs (112) to each of the network elements (106A-106N) ofthe system (100). The L3 fabric (110) may include functionality tofacilitate communications between these aforementioned components.Accordingly, the L3 fabric (110) may include any combination of localarea network (LAN) and/or wide area network (WAN) (e.g., Internet)segments, which may employ any combination of wired and/or wirelessconnections and communication protocols.

While FIG. 1 shows a configuration of components, other systemconfigurations may be used without departing from the scope of theinvention. For example, the system (100) may further include one or morevirtual machines (not shown), which may execute on any underlyinghardware component portrayed in the system (100).

In one embodiment of the invention, a virtual machine (VM) may be asoftware based emulation of a computing device. Subsequently, a VM maybe assigned (or allocated) all or a portion of various computingresources (e.g., processors, memory, storage, network bandwidth, etc.)provided by an underlying physical system (e.g., a host (102A-102N), anetwork element (106A-106N), a service device (104), etc.) serving asthe VM host. Other than allocating computing resources, hosting a VM mayfurther entail translating instructions from the VM into instructionsthat may be understood by the underlying physical hardware, operatingsystem, and/or hypervisor executing on the underlying physical system.In one embodiment of the invention, a hypervisor (i.e., a VM monitor)may be computer software that includes functionality to create, run,and/or, at least in part, manage VMs executing on an underlying physicalsystem. Moreover, a VM may include functionality to generate, receive,transmit, and/or process network traffic (e.g., MAC frames).

FIG. 2 shows a tunneling diagram in accordance with one or moreembodiments of the invention. Specifically, FIG. 2 shows a non-limitingconfiguration that includes a service device (204) directly-connected toa network element N (206N), which is designated as a service networkelement (described above). The configuration further includes a virtualtunnel end point (VTEP) N (208N), which is designated as a service VTEP(described above). VTEP N (208N) is shown to be executing on networkelement N (206N). In addition, VTEP N (208N) (and network element N(206N)) may be operatively connected to multiple other VTEPs (208A-208M)(i.e., remote VTEPs), as well as their respective network elements(206A-206M). Each of the aforementioned other network elements(206A-206M) may be directly-connected to one or more hosts (202A-202D).Network element N (206N) may also be directly-connected to one or morehosts (202E, 202F). The configuration additionally illustrates that thehosts (202A-202F) and the service device (204) are capable ofcommunicating with one another over an original virtual layer-2 (VL2)broadcast domain (210).

Moreover, in the configuration portrayed in FIG. 2, hosts A, C, and E(202A, 202C, 202E) are designated as intercept hosts. As describedabove, in one embodiment of the invention, an intercept host may referto a host where network traffic therefrom and/or thereto may beintercepted and inspected by a service device (204) based on redirectcriteria (described below). Specifically, inbound and/or outboundnetwork traffic for a host may be intercepted based on the networktraffic including information that matches redirect criteria tied to oneor more service policies or rules circulated about the network/system.Other information (outside the data included in MAC and/or VL3 frames)may be used to determine whether network traffic should be interceptedwithout departing from the scope of the invention.

In one embodiment of the invention, any inbound network traffic (i.e.,from the perspective of the service VTEP (208N)) originating from anyintercept host (202A, 202C) that resides behind a remote VTEP (208A,208M) may be assigned (or associated with) a forward-service virtualnetwork identifier (VNI) (e.g., VNI Fwd_S). Further, the forward-serviceVNI may be a unique VNI associated with (or corresponding to) aforward-service VL2 broadcast domain (not shown), which may enablecommunications between any remote VTEP (208A, 208M), behind which anintercept host (202A, 202C) lies, and the service VTEP (208N).

That is, in one embodiment of the invention, the forward-service VNI maybe associated with a forward-service VL2 broadcast domain, where theforward-service VL2 broadcast domain may be implemented as a tunnelingmechanism. Further, the tunneling mechanism may originate at a remoteVTEP (208A, 208M) behind which an intercept host (202A, 202C) resides(that is found to be associated with the forward-service VNI) and,subsequently, may terminate at the service VTEP (208N), which may beexecuting on the service network element (206N) directly-connected tothe service device (204). Accordingly, the forward-service VL2 broadcastdomain may limit communications to one direction, which may entailinbound network traffic (i.e., from the perspective of the service VTEP(208N)).

In one embodiment of the invention, any outbound network traffic (i.e.,from the perspective of the service VTEP (208N)) destined to anyintercept host (202A, 202C) that resides behind a remote VTEP (208A,208M) may be assigned (or associated with) a reverse-service VNI (e.g.,VNI Rev S). Further, the reverse-service VNI may be a unique VNIassociated with (or corresponding to) a reverse-service VL2 broadcastdomain (not shown), which may enable communications between the serviceVTEP (208N) and any remote VTEP (208A, 208M) behind which an intercepthost (202A, 202C) lies.

That is, in one embodiment of the invention, the reverse-service VNI maybe associated with a reverse-service VL2 broadcast domain, where thereverse-service VL2 broadcast domain may be implemented as a tunnelingmechanism. Further, the tunneling mechanism may originate at the serviceVTEP (208N), which may be executing on the service network element(206N) directly-connected to the service device (204), and subsequently,may terminate at a remote VTEP (208A, 208M) behind which an intercepthost (202A, 202C) lies. Accordingly, the reverse-service VL2 broadcastdomain may limit communications to one direction, which may entailoutbound network traffic (i.e., from the perspective of the service VTEP(208N)).

In one embodiment of the invention, the implementation of theforward-service and reverse-service VL2 broadcast domains may betransparent to the set of computing devices (e.g., hosts (202A-202F) andservice devices (204)) defined by the original VL2 broadcast domain(210). Subsequently, any network traffic exchanged between a host(202A-202F) of the original VL2 broadcast domain (210) and a respective,directly-connected network element (206A-206N) may include an originalVL2 broadcast domain tag (e.g., a VLAN tag) associated with the originalVL2 broadcast domain (210). Inclusion of the original VL2 broadcastdomain tag in, for example, a MAC frame associates that MAC frame withthe original VL2 broadcast domain (210), and further, permits the MACframe to be transmitted/bridged to and from any host (202A-202F) of theoriginal VL2 broadcast domain (210). Similarly, in one embodiment of theinvention, any network traffic exchanged between a service device (204)and its directly-connected network element (206N) may include theoriginal VL2 broadcast domain tag associated with the original VL2broadcast domain (210). Inclusion of original VL2 broadcast domain tagin, for example, a MAC frame not only associates the MAC frame with theoriginal VL2 broadcast domain (210), but also permits the MAC frame tobe transmitted/bridged to and from a service device (204) of theoriginal VL2 broadcast domain (210).

In one embodiment of the invention, any inbound network traffic (i.e.,from the perspective of the service network element (206N)) originatingfrom a directly-connected intercept host (202E) may be assigned to (orassociated with) the original VL2 broadcast domain (210) (e.g., VLAN 0).In such an embodiment, a directly-connected intercept host (202E) mayrefer to an intercept host that is directly-connected to a servicenetwork element (206N). Similarly, in one embodiment of the invention,any outbound network traffic (i.e., from the perspective of the servicenetwork element (206N)) destined to a directly-connected intercept host(202E) may also be assigned to (or associated with) the original VL2broadcast domain (210), thereby enabling bidirectional communicationbetween the service network element (206N) and a directly-connectedintercept host (202E).

In the configuration portrayed in FIG. 2, hosts B, D, and F (202B, 202D,202F) are designated as non-intercept hosts. As described above, in oneembodiment of the invention, a non-intercept host may refer to a hostwhere network traffic therefrom and/or thereto may not be interceptedand inspected by a service device (204) based on redirect criteria(described below). Specifically, should inbound and/or outbound networktraffic for a host include header information that mismatches redirectcriteria tied to one or more service policies or rules circulated aboutthe network/system, the aforementioned network traffic may not beintercepted. Other information (outside the data included in MAC and/orVL3 frames) may be used to determine whether network traffic should orshould not be intercepted without departing from the scope of theinvention.

In one embodiment of the invention, any inbound network traffic (i.e.,from the perspective of the service VTEP (208N)) originating from anynon-intercept host (202B, 202D) that resides behind a remote VTEP (208A,208M) may be assigned (or associated with) the original VNI (e.g., VNI0). Similarly, any outbound network traffic (i.e., from the perspectiveof the service VTEP (208N)) destined to a non-intercept host (202B,202D), residing behind a remote VTEP (208A, 208M), may also be assignedto (or associated with) the original VNI. Further, the original VNI maybe a unique VNI associated with (or corresponding to) the original VL2broadcast domain (210), which may enable bidirectional communicationsbetween any remote VTEP (208A, 208M), behind which at least onenon-intercept host (202B, 202D) lies, and the service VTEP (208N).

In one embodiment of the invention, any inbound network traffic (i.e.,from the perspective of the service network element (206N)) originatingfrom a directly-connected non-intercept host (202F) may be assigned to(or associated with) the original VL2 broadcast domain (210) (e.g., VLAN0). In such an embodiment, a directly-connected non-intercept host(202F) may be a non-intercept host that is directly-connected to aservice network element (206N). Similarly, in one embodiment of theinvention, any outbound network traffic (i.e., from the perspective ofthe service network element (206N)) destined to a directly-connectednon-intercept host (202F) may also be assigned to (or associated with)the original VL2 broadcast domain (210), thereby enabling bidirectionalcommunication between the service network element (206N) and adirectly-connected non-intercept host (202F).

While FIG. 2 shows a configuration of components, other tunnelingconfigurations may be used without departing from the scope of theinvention. For example, the configuration may further specify more thanone forward-service VL2 broadcast domain, more than one reverse-serviceVL2 broadcast domain, and/or more than one original VL2 broadcastdomain.

FIGS. 3A-3C show flowcharts describing a method for sharingcontrol-plane information in accordance with one or more embodiments ofthe invention. The various steps outlined below may be performed by acontrol-plane service (CPS) (see e.g., FIG. 1). Further, while thevarious steps in the flowcharts are presented and describedsequentially, one of ordinary skill will appreciate that some or allsteps may be executed in different orders, may be combined or omitted,and some or all steps may be executed in parallel.

Turning to FIG. 3A, in Step 300, redirect criteria is obtained. In oneembodiment of the invention, the redirect criteria may refer to one ormore service policies or rules, which specify requirements (to bematched) in order to steer or redirect network traffic towards a servicedevice. Redirect criteria may be configured by administrators of asystem (see e.g., FIG. 1), network, and/or datacenter. Further, redirectcriteria may include, but is not limited to, matching requirements tiedto: (i) a specific network element (e.g., a service policy may requirethat any network traffic originating from or destined to a specificnetwork element must be redirected to a service device for inspection);(ii) a specific network interface on a network element (e.g., a servicepolicy may require that any inbound and/or outbound network traffictraversing a specific network interface on a network element must beredirected to a service device for inspection); (iii) a specific host orvirtual machine (e.g., a service policy may require that any networktraffic originating from or destined to a specific host or virtualmachine must be redirected to a service device for inspection); (iv) aspecific source Internet Protocol (IP) or media access control (MAC)address and destination IP or MAC address pair (e.g., a service policymay require that any network traffic including a specific source IP/MACaddress and a specific destination IP/MAC address must be redirected toa service device for inspection); and (v) a specific VL2 broadcastdomain (e.g., a specific virtual local area network (VLAN)) and IP/MACaddress pair (e.g., a service policy may require that any networktraffic including a specific VL2 broadcast domain broadcast domain(e.g., a specific VLAN tag) (or VNI) and a specific IP/MAC address(associated with either a source or a destination) must be redirected toa service device for inspection). Embodiments of the invention are notlimited to the above-mentioned examples.

In Step 302, a set of virtual tunnel end points (VTEPs) is identified.In one embodiment of the invention, the set of VTEPs may be identifiedfrom or using one or more data structures, consolidated on the CPS,which may track various information pertinent to one or more systems,networks, datacenters, zones, and/or subnets. By way of an example, theset of VTEPs may be identified from or using a VTEP table, which mayexhibit various entries, where each entry may pertain to a unique VTEP.Further, each entry may, for example, specify: a VTEP IP addressassociated with the VTEP; a VTEP hostname referring to a name of theoverlay network with which the VTEP may be associated; a VTEP host typereferring to a type of the overlay tunnel (e.g., VXLAN tunnel) withwhich the VTEP may originate or terminate; and one or more virtualnetwork identifiers (VNIs) with which the overlay network may beassociated.

In Step 304, the redirect criteria (obtained in Step 300) is transmittedto each VTEP (identified in Step 302). Thereafter, in Step 306, a set ofintercept host (or intercept virtual machine) MAC addresses isidentified using the redirect criteria. As described above, in oneembodiment of the invention, an intercept host (or intercept virtualmachine) may refer to a host (or virtual machine) where network traffictherefrom and/or thereto may be intercepted and inspected by a servicedevice. Further, a determination of which network traffic requiresinterception and inspection may be based on redirect criteria.Accordingly, should a host (or virtual machine) be specified in theredirect criteria (i.e., via their respective MAC address, IP address,or some other unique identifier), that host/virtual machine may beconsidered an intercept host (or an intercept virtual machine).

In Step 308, for each intercept host (or virtual machine) MAC address(identified in Step 306), a first MAC programming instruction (MPI) isgenerated. In one embodiment of the invention, each first MPI mayrepresent a computer readable instruction, which may include particularinformation, thus directing a recipient (e.g., any or all VTEPs(identified in Step 302)) to update their MAC address table accordinglyusing the particular information. The aforementioned particularinformation specified in each first MPI may include, but is not limitedto: an intercept host (or intercept virtual machine) MAC address(identified in Step 306); an original VNI identifier (ID) correspondingto an original VL2 broadcast domain; and a far network interface (FNI)(see e.g., FIG. 2) tag or reference. Moreover, through each first MPI,recipients may program any and all intercept host (or intercept virtualmachine) MAC address, specified in the redirect criteria, on theoriginal VNI behind their respective FNI.

Turning to FIG. 3B, in Step 320, for each intercept host (or virtualmachine) MAC address (identified in Step 306), a second MPI isgenerated. In one embodiment of the invention, each second MPI mayrepresent another computer readable instruction, which may include otherparticular information, thus directing a recipient (e.g., any or allVTEPs (identified in Step 302)) to update their MAC address tableaccordingly using the other particular information. The aforementionedother particular information specified in each second MPI may include,but is not limited to: an intercept host (or intercept virtual machine)MAC address (identified in Step 306); a forward-service VNI ID; and anear network interface (NNI) (see e.g., FIG. 2) tag or reference.Moreover, through each second MPI, recipients may program any and allintercept host (or intercept virtual machine) MAC address, specified inthe redirect criteria, on the forward-service VNI behind theirrespective NNI.

In Step 322, a service-specific network interface configuration (NIC) isobtained. In one embodiment of the invention, the service-specific NICmay refer to a computer readable script that outlines a desiredconfiguration targeting one or more properties (or attributes) of one ormore network interfaces belonging to or residing on a service recipient(e.g., a service VTEP (see e.g., FIG. 2)). By way of examples, theservice-specific NIC may configure: (i) a membership property (orattribute) belonging to the NNI of a service recipient such that the NNIis enrolled as a member of the reverse-service VNI and/or theforward-service VNI; (ii) a membership property (or attribute) belongingto the FNI of a service recipient such that the FNI is enrolled as amember of the original VNI; (iii) a learning property (or attribute)belonging to the FNI of a service recipient such that MAC learning atthe FNI is disabled; (iv) a membership property (or attribute) belongingto the loop-end interface (LEI) (see e.g., FIG. 2) of a servicerecipient such that the LEI is enrolled as a member of thereverse-service VNI; (v) a learning property (or attribute) belonging tothe LEI of a service recipient such that MAC learning at the LEI isdisabled; (vi) a mirroring property (or attribute) belonging to the FNIof a service recipient such that the FNI mirrors (i.e., provides a copyof) any received or ingress network traffic at the FNI to the loop-startinterface (LSI) (see e.g., FIG. 2) of the service recipient; and (vii) aflooding property (or attribute) belonging to the LEI of a servicerecipient such that unknown unicast flooding at the LEI is disabled.Embodiments of the invention are not limited to the above-mentionedexamples.

In Step 324, a set of service-specific traffic flow rules (TFRs) isobtained. In one embodiment of the invention, a flow (or a networktraffic flow) may refer to a network traffic sequence (i.e., a sequenceof packets) that shares L2 and/or L3 header information—e.g., a samesource IP and/or MAC address, a same destination IP and/or MAC address,a same VL2 broadcast domain tag, an ingress network interface ID for aphysical or virtual network interface whereat the flow arrived, etc. Aservice-specific TFR, subsequently, may represent a flow-pertinent ruleor policy that applies an action set (or statement) to a network trafficflow at/on a service recipient (e.g., a service VTEP) that includes L2and/or L3 information specified in a corresponding match set (orstatement). Accordingly, a match set for a service-specific TFR mayspecify one or more header field values shared by a network trafficflow, whereas a corresponding action set for the service-specific TFRmay dictate one or more actions (or functions) to be performed to/on thenetwork traffic flow as it traverses the service recipient—e.g., routeor bridge the associated network traffic, drop the associated networktraffic, modify one or more header and/or data fields specified in theassociated network traffic, etc.

By way of examples, the set of service-specific TFRs may specify thefollowing instructions: (i) translate any egress network traffictraversing the NNI of a service recipient from the forward-service VL2broadcast domain to the original VL2 broadcast domain; (ii) translateany ingress network traffic traversing the NNI of a service recipientfrom the original VL2 broadcast domain to the reverse-service VL2broadcast domain; (iii) translate any ingress network traffic traversingthe LEI of a service recipient from the original VL2 broadcast domain tothe reverse-service VL2 broadcast domain; (iv) drop any egress networktraffic, associated with the reverse-service VL2 broadcast domain, thattraverses the NNI of a service recipient; and (v) drop any egressnetwork traffic, associated with the reverse-service VL2 broadcastdomain, that traverses the LEI of a service recipient. Embodiments ofthe invention are not limited to the above-mentioned examples.

In Step 326, a service VTEP subset is identified (from the set of VTEPsidentified in Step 302). As described above, in one embodiment of theinvention, a service VTEP may refer to a VTEP that executes on a networkthat may be directly-connected to a service device. Further, the serviceVTEP subset may be identified from or using one or more data structures,consolidated on the CPS, which may track various information pertinentto one or more systems, networks, datacenters, zones, and/or subnets.

By way of an example, the service VTEP subset may be identified from orusing a combination of a MAC-to-VTEP table and a service device table.That is, initially, a service device table may be identified, which mayinclude various entries, where each entry pertains to a unique servicedevice. Further, each entry in the service device table may consolidatevarious information regarding a respective service device, which mayinclude, but is not limited to: a MAC address associated with theservice device; an IP address associated with the service device; adevice type associated with the service device—e.g., a network securitydevice, a network filter device, etc.; and a status associated with theservice device. Using the service device table, one or more servicedevice MAC addresses (associated with one or more service devices,respectively) may be obtained. Thereafter, the obtained service deviceMAC address(es) may be used to perform lookups on the MAC-to-VTEP table.The MAC-to-VTEP table may refer to a data structure that includesvarious entries, where each entry specifies a host MAC address to VTEPIP address mapping. Further, each mapping may reveal a host, a virtualmachine, or a service device (identified via a MAC address) that may liebehind a VTEP (identified via an IP address). Subsequently, the obtainedservice device MAC address(es) may be used in conjunction with theMAC-to-VTEP table to identify one or more corresponding VTEP IPaddresses associated with one or more VTEPs, respectively, behind whichmay lie a service device. As described above, VTEPs behind which lie (orare directly-connected to) a service device may be referred to asservice VTEPs.

In Step 328, a first MPI set, entailing a first MPI (generated in Step308) for each intercept host MAC address (identified in Step 306), istransmitted to each service VTEP (identified in Step 326). Further, asecond MPI set, entailing a second MPI (generated in Step 320) for eachintercept host MAC address (identified in Step 306), is also transmittedto each service VTEP (identified in Step 326). Moreover, theservice-specific NIC (obtained in Step 322) and the set ofservice-specific TFRs (obtained in Step 324) are also transmitted toeach service VTEP (identified in Step 326).

In Step 330, an intercept-specific NIC is obtained. In one embodiment ofthe invention, the intercept-specific NIC may refer to a computerreadable script that outlines a desired configuration targeting one ormore properties (or attributes) of one or more network interfacesbelonging to or residing on an intercept recipient (e.g., any VTEPbehind which an intercept host lies). By way of an example, theintercept-specific NIC may configure a membership property (orattribute) belonging to an intercept network interface (INI) (i.e., aphysical or virtual network interface that directly-connects to anintercept host) of an intercept recipient such that the INI is enrolledas a member of the original VNI, the reverse-service VNI and/or theforward-service VNI. Embodiments of the invention are not limited to theabove-mentioned example.

Turning to FIG. 3C, in Step 340, a set of intercept-specific TFRs isobtained. As described above, a flow (or a network traffic flow) mayrefer to a network traffic sequence (i.e., a sequence of packets) thatshares L2 and/or L3 header information—e.g., a same source IP and/or MACaddress, a same destination IP and/or MAC address, a same VL2 broadcastdomain tag, an ingress network interface ID for a physical or virtualnetwork interface whereat the flow arrived, etc. Subsequently, in oneembodiment of the invention, an intercept-specific TFR may represent aflow-pertinent rule or policy that applies an action set (or statement)to a network traffic flow at/on an intercept recipient (e.g., any VTEPbehind which an intercept host lies) that includes L2 and/or L3information specified in a corresponding match set (or statement).Accordingly, a match set for an intercept-specific TFR may specify oneor more header field values shared by a network traffic flow, whereas acorresponding action set for the intercept-specific TFR may dictate oneor more actions (or functions) to be performed to/on the network trafficflow as it traverses the intercept recipient—e.g., route or bridge theassociated network traffic, drop the associated network traffic, modifyone or more header and/or data fields specified in the associatednetwork traffic, etc.

By way of examples, the set of intercept-specific TFRs may specify thefollowing instructions: (i) translate any ingress network traffictraversing an INI of an intercept recipient from the original VL2broadcast domain to the forward-service VL2 broadcast domain, where thesource MAC address specified in the ingress network traffic isassociated with an intercept host; (ii) translate any egress networktraffic traversing an INI of an intercept recipient from thereverse-service VL2 broadcast domain to the original VL2 broadcastdomain; (iii) drop any broadcast egress network traffic, associated withthe original VL2 broadcast domain, that traverses an INI of an interceptrecipient; (iv) drop any egress network traffic, associated with thereverse-service VL2 broadcast domain, that traverses an INI of anintercept recipient, where the source MAC address specified in theegress network traffic is associated with an intercept host; and (v)drop any egress network traffic, associated with the forward-service VL2broadcast domain, that traverses an INI of an intercept recipient.Embodiments of the invention are not limited to the above-mentionedexamples.

In Step 342, an intercept VTEP subset is identified (from the set ofVTEPs identified in Step 302). In one embodiment of the invention, anintercept VTEP may refer to a VTEP behind which at least one intercepthost (described above) lies. Further, the intercept VTEP subset may beidentified from or using one or more data structures, consolidated onthe CPS, which may track various information pertinent to one or moresystems, networks, datacenters, zones, and/or subnets.

By way of an example, the intercept VTEP subset may be identified fromor using a combination of a MAC-to-VTEP table (described above) and theone or more intercept host MAC addresses (identified in Step 306). Thatis, the identified intercept host MAC address(es) may be used to performlookups on the MAC-to-VTEP table to identify one or more correspondingVTEP IP addresses associated with one or more VTEPs, respectively,behind which may lie at least one intercept host. In one embodiment ofthe invention, VTEPs behind which lie (or are directly-connected to) atleast one intercept host may be referred to as intercept VTEPs.

In Step 344, for each intercept VTEP (identified in Step 342), anintercept host MAC address subset (relevant to an intercept VTEP) isidentified. In one embodiment of the invention, the intercept host MACaddress subset may include one or more intercept host MAC addressesassociated with one or more intercept hosts, respectively, which liebehind (or may be directly-connected to) the intercept VTEP. Further,the intercept host MAC address subset may be identified from or usingone or more data structures, consolidated on the CPS, which may trackvarious information pertinent to one or more systems, networks,datacenters, zones, and/or subnets.

By way of an example, the intercept host MAC address subset (for a givenintercept VTEP) may be identified from or using a combination of aVTEP-to-Host table, the set of intercept host MAC addresses (identifiedin Step 306), and the intercept VTEP IP address associated with thegiven intercept VTEP (identified in Step 342). In one embodiment of theinvention, the VTEP-to-Host table may refer to a data structure thatincludes one or more entries, where each entry pertains to a uniqueVTEP. Specifically, each entry in the VTEP-to-Host table may map VTEPinformation for one VTEP—e.g., a VTEP ID, a VTEP IP address, one or moreVL2 broadcast domain IDs, one or more VNI IDs, etc.—to host informationfor one or more hosts (or virtual machines)—e.g., a host MAC address, ahost IP address, etc.—that have been recorded to lie behind the oneVTEP. Accordingly, for a given intercept VTEP, a lookup may be performedon the VTEP-to-Host table using the intercept VTEP IP address associatedwith the given intercept VTEP. Based on the lookup, one or more host MACaddresses may be identified, which may represent the host(s) that residebehind the given intercept VTEP. Thereafter, the host MAC address(es)(identified during the aforementioned lookup) may be compared againstthe set of intercept host MAC addresses (identified in Step 306),thereby leading to the identification of an intersection subset of hostMAC addresses. The intersection subset of host MAC addresses (i.e., theintercept host MAC address subset for a given intercept VTEP) may thusinclude MAC addresses associated with hosts (or virtual machines) thatare both intercept hosts and reside behind the given intercept VTEP.

In Step 346, for each intercept VTEP (identified in Step 342), a set ofone or more third MPIs is generated. Specifically, in one embodiment ofthe invention, a third MPI may be generated for each intercept host MACaddress (identified into the intercept host MAC address subset in Step344) for each given intercept VTEP. Further, for a given intercept VTEP,each third MPI may represent a computer readable instruction, which mayinclude particular information, thus directing a recipient (i.e., thegiven intercept VTEP) to update their MAC address table accordinglyusing the particular information. The aforementioned particularinformation specified in each second MPI (for a given intercept VTEP)may include, but is not limited to: an intercept host (or interceptvirtual machine) MAC address (identified into the intercept host MACaddress subset in Step 344); a reverse-service VNI ID; and an interceptnetwork interface (INI) (described above) tag or reference. Moreover,through each third MPI, the given intercept VTEP may program any and allintercept host (or intercept virtual machine) MAC address, relevant (ordirectly-connected) to the given intercept VTEP, on the reverse-serviceVNI behind a respective INI.

In Step 348, a third MPI set, entailing a third MPI (generated in Step346) for each relevant intercept host MAC address (identified into theintercept host MAC address subset in Step 344 for a given interceptVTEP), is transmitted to the given intercept VTEP. Further, a copy ofthe intercept-specific NIC (obtained in Step 330) and a copy of the setof intercept-specific TFRs (obtained in Step 340) are also transmittedto the given intercept VTEP. Hereinafter, if additional intercept VTEPs(identified in Step 342) remain, Steps 344 to 348 may be repeated foreach remaining intercept VTEP. On the other hand, if no additionalintercept VTEPs remain, the process ends.

FIGS. 4A and 4B show flowcharts describing a method for receiving andprocessing control-plane information in accordance with one or moreembodiments of the invention. The various steps outlined below may beperformed by a service virtual tunnel end point (VTEP) (see e.g., FIG.2). Further, while the various steps in the flowcharts are presented anddescribed sequentially, one of ordinary skill will appreciate that someor all steps may be executed in different orders, may be combined oromitted, and some or all steps may be executed in parallel.

Turning to FIG. 4A, in Step 400, redirect criteria is received from acontrol-plane service (CPS) (see e.g., FIG. 1). In one embodiment of theinvention, redirect criteria may refer to one or more service policiesor rules, which specify requirements (to be matched) in order to steeror redirect network traffic towards a service device. Example servicepolicies and/or rules, representative of redirect criteria, are furtherdescribed above with respect to FIG. 3A. In Step 402, the redirectcriteria (received in Step 400) is subsequently stored. Specifically, inone embodiment of the invention, the received redirect criteria may bestored in non-volatile (or persistent) memory on-board the networkelement on which the service VTEP may be executing.

In Step 404, also from the CPS, a first media access control (MAC)programming instruction (MPI) set is received. In one embodiment of theinvention, the first MPI set may include one or more first MPIs, whereeach first MPI represents a computer readable instruction that specifiesparticular information and directs the updating of a MAC address tableusing the particular information. Further, the aforementioned particularinformation specified in each first MPI may include, but is not limitedto: an intercept host (or intercept virtual machine) MAC address; anoriginal virtual network identifier (VNI) ID corresponding to anoriginal virtual layer-2 (VL2) broadcast domain; and a far networkinterface (FNI) (see e.g., FIG. 2) tag or reference.

In Step 406, a MAC address table (of the service VTEP) is updated usingthe first MPI set (received in Step 404). Specifically, in oneembodiment of the invention, a new table entry may be appended to theMAC address table or an existing table entry of the MAC address tablemay be modified based on the above-mentioned particular informationspecified in each first MPI of the first MPI set. More specifically,through the processing of each first MPI, the MAC address table may beupdated to include entries that map any and all intercept host (orintercept virtual machine) MAC address(es), specified in the redirectcriteria, on the original VNI behind the FNI of the service VTEP.

In Step 408, also from the CPS, a second MPI set is received. In oneembodiment of the invention, the second MPI set may include one or moresecond MPIs, where each second MPI represents a computer readableinstruction that specifies particular information and directs theupdating of the MAC address table (of the service VTEP) using theparticular information. Further, the aforementioned particularinformation specified in each second MPI may include, but is not limitedto: an intercept host (or intercept virtual machine) MAC address; aforward-service VNI ID corresponding to a forward-service VL2 broadcastdomain; and a near network interface (NNI) (see e.g., FIG. 2) tag orreference.

Turning to FIG. 4B, in Step 420, the MAC address table (of the serviceVTEP) is further updated using the second MPI set (received in Step408). Specifically, in one embodiment of the invention, a new tableentry may be appended to the MAC address table or an existing tableentry of the MAC address table may be modified based on theabove-mentioned particular information specified in each second MPI ofthe second MPI set. More specifically, through the processing of eachsecond MPI, the MAC address table may be updated to include entries thatmap any and all intercept host (or intercept virtual machine) MACaddress(es), specified in the redirect criteria, on the forward-serviceVNI behind the NNI of the service VTEP.

In Step 422, also from the CPS, a service-specific network interfaceconfiguration (NIC) is received. In one embodiment of the invention, theservice-specific NIC may refer to a computer readable script thatoutlines a desired configuration targeting one or more properties (orattributes) of one or more physical (or virtual) network interfaces ofthe service VTEP.

In Step 424, one or more physical (or virtual) network interfaces (ofthe service VTEP) are configured based on the service-specific NIC(received in Step 422). By way of examples: (i) a membership property(or attribute) belonging to the NNI of the service VTEP may beconfigured such that the NNI is enrolled as a member of thereverse-service VNI and/or the forward-service VNI; (ii) a membershipproperty (or attribute) belonging to the FNI of the service VTEP may beconfigured such that the FNI is enrolled as a member of the originalVNI; (iii) a learning property (or attribute) belonging to the FNI ofthe service VTEP may be configured such that MAC learning at the FNI isdisabled; (iv) a membership property (or attribute) belonging to theloop-end interface (LEI) (see e.g., FIG. 2) of the service VTEP may beconfigured such that the LEI is enrolled as a member of thereverse-service VNI; (v) a learning property (or attribute) belonging tothe LEI of the service VTEP may be configured such that MAC learning atthe LEI is disabled; (vi) a mirroring property (or attribute) belongingto the FNI of the service VTEP may be configured such that the FNImirrors (i.e., provides a copy of) any received or ingress networktraffic at the FNI to the loop-start interface (LSI) (see e.g., FIG. 2)of the service VTEP; and (vii) a flooding property (or attribute)belonging to the LEI of the service VTEP may be configured such thatunknown unicast flooding at the LEI is disabled. Embodiments of theinvention are not limited to the above-mentioned examples.

In Step 426, also from the CPS, a set of service-specific traffic flowrules (TFRs) is received. In one embodiment of the invention, a flow (ora network traffic flow) may refer to a network traffic sequence (i.e., asequence of packets) that shares L2 and/or L3 header information—e.g., asame source Internet Protocol (IP) and/or MAC address, a samedestination IP and/or MAC address, a same VL2 broadcast domain tag, aningress network interface ID for a physical or virtual network interfacewhereat the flow arrived, etc. A service-specific TFR, subsequently, mayrepresent a flow-pertinent rule or policy that applies an action set (orstatement) to a network traffic flow while the flow traverses theservice VTEP, where the network traffic flow includes L2 and/or L3information specified in a corresponding match set (or statement).Accordingly, a match set for a service-specific TFR may specify one ormore header field values shared by a network traffic flow, whereas acorresponding action set for the service-specific TFR may dictate one ormore actions (or functions) to be performed to/on the network trafficflow as the flow traverses the service VTEP. These actions and/orfunctions may include, but are not limited to, routing or bridging thenetwork traffic flow, dropping the network traffic flow, modifying oneor more header and/or data fields specified across the network trafficflow, etc.

By way of examples, the set of service-specific TFRs may specify thefollowing instructions: (i) translate any egress network traffictraversing the NNI of the service VTEP from the forward-service VL2broadcast domain to the original VL2 broadcast domain; (ii) translateany ingress network traffic traversing the NNI of the service VTEP fromthe original VL2 broadcast domain to the reverse-service VL2 broadcastdomain; (iii) translate any ingress network traffic traversing the LEIof the service VTEP from the original VL2 broadcast domain to thereverse-service VL2 broadcast domain; (iv) drop any egress networktraffic, associated with the reverse-service VL2 broadcast domain, thattraverses the NNI of the service VTEP; and (v) drop any egress networktraffic, associated with the reverse-service VL2 broadcast domain, thattraverses the LEI of the service VTEP. Embodiments of the invention arenot limited to the above-mentioned examples.

In Step 428, the set of service-specific TFRs (received in Step 426) isstored. Specifically, in one embodiment of the invention, the receivedset of service-specific TFRs may be stored in non-volatile (orpersistent) memory on-board the network element on which the serviceVTEP may be executing.

FIGS. 5A and 5B show flowcharts describing a method for receiving andprocessing control-plane information in accordance with one or moreembodiments of the invention. The various steps outlined below may beperformed by an intercept virtual tunnel end point (VTEP) (i.e., a VTEPbehind which at least one intercept host lies). Further, while thevarious steps in the flowcharts are presented and describedsequentially, one of ordinary skill will appreciate that some or allsteps may be executed in different orders, may be combined or omitted,and some or all steps may be executed in parallel.

Turning to FIG. 5A, in Step 500, redirect criteria is received from acontrol-plane service (CPS) (see e.g., FIG. 1). In one embodiment of theinvention, redirect criteria may refer to one or more service policiesor rules, which specify requirements (to be matched) in order to steeror redirect network traffic towards a service device. Example servicepolicies and/or rules, representative of redirect criteria, are furtherdescribed above with respect to FIG. 3A. In Step 502, the redirectcriteria (received in Step 500) is subsequently stored. Specifically, inone embodiment of the invention, the received redirect criteria may bestored in non-volatile (or persistent) memory on-board the networkelement on which the intercept VTEP may be executing.

In Step 504, also from the CPS, a media access control (MAC) programminginstruction (MPI) set is received. In one embodiment of the invention,the MPI set may include one or more MPIs, where each MPI represents acomputer readable instruction that specifies particular information anddirects the updating of a MAC address table using the particularinformation. Further, the aforementioned particular informationspecified in each MPI may include, but is not limited to: an intercepthost (or intercept virtual machine) MAC address; a reverse-servicevirtual network identifier (VNI) ID corresponding to a reverse-servicevirtual layer-2 (VL2) broadcast domain; and an intercept networkinterface (INI) (see e.g., FIG. 2) tag or reference.

In Step 506, a MAC address table (of the intercept VTEP) is updatedusing the MPI set (received in Step 504). Specifically, in oneembodiment of the invention, a new table entry may be appended to theMAC address table or an existing table entry of the MAC address tablemay be modified based on the above-mentioned particular informationspecified in each MPI of the MPI set. More specifically, through theprocessing of each MPI, the MAC address table may be updated to includeentries that map any and all intercept host (or intercept virtualmachine) MAC address(es), specified in the redirect criteria, on thereverse-service VNI behind one or more INIs of the intercept VTEP.

In Step 508, also from the CPS, an intercept-specific network interfaceconfiguration (NIC) is received. In one embodiment of the invention, theintercept-specific NIC may refer to a computer readable script thatoutlines a desired configuration targeting one or more properties (orattributes) of one or more physical (or virtual) network interfaces ofthe intercept VTEP.

Turning to FIG. 5B, in Step 520, one or more physical (or virtual)network interfaces (of the intercept VTEP) are configured based on theintercept-specific NIC (received in Step 508). By way of example, amembership property (or attribute) belonging to an INI of the interceptVTEP may be configured such that the INI is enrolled as a member of theoriginal VNI, the reverse-service VNI, and/or the forward-service VNI.Embodiments of the invention are not limited to the above-mentionedexample.

In Step 522, also from the CPS, a set of intercept-specific traffic flowrules (TFRs) is received. In one embodiment of the invention, a flow (ora network traffic flow) may refer to a network traffic sequence (i.e., asequence of packets) that shares L2 and/or L3 header information—e.g., asame source Internet Protocol (IP) and/or MAC address, a samedestination IP and/or MAC address, a same VL2 broadcast domain tag, aningress network interface ID for a physical or virtual network interfacewhereat the flow arrived, etc. An intercept-specific TFR, subsequently,may represent a flow-pertinent rule or policy that applies an action set(or statement) to a network traffic flow while the flow traverses theintercept VTEP, where the network traffic flow includes L2 and/or L3information specified in a corresponding match set (or statement).Accordingly, a match set for an intercept-specific TFR may specify oneor more header field values shared by a network traffic flow, whereas acorresponding action set for the intercept-specific TFR may dictate oneor more actions (or functions) to be performed to/on the network trafficflow as the flow traverses the intercept VTEP. These actions and/orfunctions may include, but are not limited to, routing or bridging thenetwork traffic flow, dropping the network traffic flow, modifying oneor more header and/or data fields specified across the network trafficflow, etc.

By way of examples, the set of intercept-specific TFRs may specify thefollowing instructions: (i) translate any ingress network traffictraversing an INI of the intercept VTEP from the original VL2 broadcastdomain to the forward-service VL2 broadcast domain, where the source MACaddress specified in the ingress network traffic is associated with anintercept host; (ii) translate any egress network traffic traversing anINI of the intercept VTEP from the reverse-service VL2 broadcast domainto the original VL2 broadcast domain; (iii) drop any broadcast egressnetwork traffic, associated with the original VL2 broadcast domain, thattraverses an INI of the intercept VTEP; (iv) drop any egress networktraffic, associated with the reverse-service VL2 broadcast domain, thattraverses an INI of the intercept VTEP, where the source MAC addressspecified in the egress network traffic is associated with an intercepthost; and (v) drop any egress network traffic, associated with theforward-service VL2 broadcast domain, that traverses an INI of theintercept VTEP. Embodiments of the invention are not limited to theabove-mentioned examples.

In Step 524, the set of intercept-specific TFRs (received in Step 508)is stored. Specifically, in one embodiment of the invention, thereceived set of intercept-specific TFRs may be stored in non-volatile(or persistent) memory on-board the network element on which theintercept VTEP may be executing.

FIGS. 6A-6C show flowcharts describing a method for transmittingredirected unicast network traffic within a zone in accordance with oneor more embodiments of the invention. The various steps outlined belowmay be performed by a non-service virtual tunnel end point (VTEP) (i.e.,a VTEP not directly-connected to a service device). Further, while thevarious steps in the flowcharts are presented and describedsequentially, one of ordinary skill will appreciate that some or allsteps may be executed in different orders, may be combined or omitted,and some or all steps may be executed in parallel.

Turning to FIG. 6A, in Step 600, a unicast media access control (MAC)frame is received. In one embodiment of the invention, a unicast MACframe may refer to a MAC frame addressed to a single destination host(or destination virtual machine). Further, the unicast MAC frame mayhave been generated and transmitted by, and thus, may have originatedfrom a directly-connected source host (or source virtual machine).Moreover, in one embodiment of the invention, the unicast MAC frame mayinclude or specify an original virtual layer-2 (VL2) broadcast domaintag (e.g., an original virtual local area network (VLAN) tag). Theoriginal VL2 broadcast domain tag may include information thatidentifies the unicast MAC frame as being associated with an originalVL2 broadcast domain (e.g., an original VLAN). The original VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In another embodiment of the invention, in Step 602, a unicast MAC framelacking a VL2 broadcast domain tag may be received. Accordingly, theunicast MAC frame may be received untagged. In such an embodiment, basedon identifying that the unicast MAC frame is untagged, in Step 604, anetwork interface configuration (NIC) for the network interface, throughwhich the untagged unicast MAC frame had been received, is accessed. Inone embodiment of the invention, the NIC for the network interface maytrack various properties (or attributes) associated with the networkinterface. By way an example, the NIC for the network interface maytrack a membership property (or attribute) belonging to the networkinterface, which may identify one or more virtual network identifiers(VNIs), including a default VNI, of which the network interface may beenrolled as a member.

In Step 606, from the NIC (accessed in Step 604), the default VNI ofwhich the network interface (i.e., through which the untagged unicastMAC frame had been received) is a member is identified. Specifically, asmentioned above, the default VNI may be identified by examining amembership property (or attribute) disclosed in the NIC of the networkinterface. Further, the default VNI may subsequently identify thecorresponding default VL2 broadcast domain with which the default VNI isassociated. Accordingly, in one embodiment of the invention, theidentified default VNI for the network interface may identify theoriginal VL2 broadcast domain as the default VL2 broadcast domainassociated with the default VNI. In one or more other embodiments of theinvention, the identified default VNI for the network interface mayalternatively identify any other VL2 broadcast domain as the default VL2broadcast domain associated with the default VNI. Hereinafter, theheader field of the unicast MAC frame associated with the VL2 broadcastdomain tag may subsequently be modified to include the default VL2broadcast domain tag (e.g., the original VL2 broadcast domain tag).

In Step 608, after receipt of the unicast MAC frame (either in Step 600or through Steps 602 to 606), a determination is made as to whether thesource host is an intercept host. In one embodiment of the invention, anintercept host may refer to a host where network traffic therefromand/or thereto may be intercepted and inspected by a service device.Identification of the source host as an intercept host may be determinedbased on one or more service policies (specified in redirect criteria(described above)) and header information specified in the unicast MACframe. For example, the source host may be recognized as an intercepthost because the source host MAC address (specified in the headerinformation of the unicast MAC frame) is tied to a service policy orrule specified in the redirect criteria. By way of another example, thesource host may be recognized as an intercept host because the sourcehost IP address (specified in header information of the unicast MACframe) is tied to a service policy or rule specified in the redirectcriteria.

In one embodiment of the invention, if it is determined that the sourcehost (or source virtual machine) is tied to any service policy or rulespecified in the redirect criteria, then the source host (or sourcevirtual machine) is recognized as an intercept host. Accordingly, basedon this determination, the process may proceed to Step 620 (see e.g.,FIG. 6B). On the other hand, in another embodiment of the invention, ifit is alternatively determined that the source host (or source virtualmachine) is not tied to any service policy or rule specified in theredirect criteria, then the source host (or source virtual machine) isrecognized as a non-intercept host (or virtual machine). Accordingly,based on this determination, the process may alternatively proceed toStep 640 (see e.g., FIG. 6C).

Turning to FIG. 6B, in Step 620, after determining (in Step 608) thatthe source host (or source virtual machine) is an intercept host (orvirtual machine), the unicast MAC frame (received in Step 600 or 602) istranslated into the forward-service VL2 broadcast domain. In oneembodiment of the invention, this translation may transpire because ofan intercept-specific traffic flow rule (TFR) (described above)—e.g.,dictating the translation of any ingress network traffic (i.e., theunicast MAC frame) traversing an intercept network interface (INI) (seee.g., FIG. 2) of an intercept VTEP from the original VL2 broadcastdomain to the forward-service VL2 broadcast domain, where the source MACaddress specified in the ingress network traffic is associated with anintercept host. Furthermore, the aforementioned translation may entailreplacing the original VL2 broadcast domain tag, specified in headerinformation of the unicast MAC frame, with a forward-service VL2broadcast domain tag. The forward-service VL2 broadcast domain tag mayinclude information that identifies the unicast MAC frame as beingassociated with a forward-service VL2 broadcast domain. Theforward-service VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.

In Step 622, a lookup is performed on a forward-service virtual networkidentifier (VNI) using a destination host (or destination virtualmachine) MAC address specified in header information of the unicast MACframe. In one embodiment of the invention, the forward-service VNI mayidentify with a forward-service VL2 broadcast domain. Further, theforward-service VL2 broadcast domain may be implemented as a unique,unidirectional overlay tunnel (e.g., a virtual extensible local areanetwork (VXLAN) tunnel) through which network traffic, intercepted basedon redirect criteria, may be redirected to a service device forinspection. Should any host MAC address be known on the forward-serviceVNI, network traffic sourced from and/or addressed to that host MACaddress may be redirected to a near network interface (NNI) of a serviceVTEP, behind which the service device may reside.

Moreover, in one embodiment of the invention, the above-mentioned lookupmay entail searching through one or more entries in a MAC-to-VNI tablefor an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 624, based on the lookup (performed in Step 622), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the forward-service VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the forward-service VNI, then thedestination host/virtual machine MAC address is recognized as beingknown on the forward-service VNI. Accordingly, based on thisdetermination, the process may proceed to Step 626. On the other hand,in another embodiment of the invention, if it is alternativelydetermined that an entry in the MAC-to-VNI table fails to map thedestination host (or destination virtual machine) MAC address to atleast the forward-service VNI, then the destination host/virtual machineMAC address is recognized as being unknown on the forward-service VNI.Accordingly, based on this determination, the process may alternativelyproceed to Step 630.

In Step 626, after determining (in Step 624) that the destination host(or destination virtual machine) MAC address is known on theforward-service VNI, a network interface out of which the unicast MACframe may be transmitted, towards the destination host/virtual machine,is identified. In one embodiment of the invention, the aforementionednetwork interface, entailing either a physical or virtual networkinterface, may be identified through the performance of a lookup on aMAC address table using the destination host (or destination virtualmachine) MAC address. The MAC address table may refer to a datastructure that maintains one or more entries, where each entry not onlyspecifies out which network interface to forward network traffic, butalso through which overlay tunnel, if any, should the network traffic betransmitted through in order to reach their desired destination or anext hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through a certain network interface, leadingto a service VTEP, and using an overlay tunnel that implements theforward-service VL2 broadcast domain. Subsequently, the unicast MACframe may be encapsulated in a virtual layer-3 (VL3) frame such as, forexample, a VXLAN frame, where the VL3 frame may include headerinformation that specifies, at least in part, the forward-service VNI.

In Step 628, the VL3 frame (obtained in Step 626) is transmitted,through an L3 fabric (see e.g., FIG. 1), towards the service VTEP.Specifically, in one embodiment of the invention, the VL3 frame maytraverse through an overlay tunnel—i.e., representative of theforward-service VL2 broadcast domain—that originates at the non-serviceVTEP (which had obtained the unicast MAC frame in Step 600 or 602) and,subsequently, terminates at the service VTEP, behind which a servicedevice resides.

In Step 630, after determining (in Step 624) that the destination host(or destination virtual machine) MAC address is unknown on theforward-service VNI, the unicast MAC frame is flooded to alldestinations known on the forward-service VNI. In one embodiment of theinvention, through MAC learning and/or the receipt of MAC programminginstructions (MPIs) (described above), destinations known on theforward-service VNI may include, but are not limited to: (i) the nearnetwork interface (NNI) of a service VTEP, behind which a service devicemay reside; and (ii) at least one intercept network interface (INI) (seee.g., FIG. 2) of one or more intercept VTEPs, behind which at least oneintercept host (or intercept virtual machine) may reside. Furthermore,based on the imposition of intercept-specific traffic flow rules (TFRs),copies of the unicast MAC frame, intended to be flooded to the at leastone INI of one or more intercept VTEPs, may be dropped in order toreduce duplicate network traffic delivery. Accordingly, only the copy ofthe unicast MAC frame, intended to be flooded to the NNI of the serviceVTEP, may be released. In one embodiment of the invention, flooding ofthe unicast MAC frame to the NNI of the service VTEP may entailencapsulating the unicast MAC frame in a VL3 frame that specifies, atleast in part, the forward-service VNI in header information and,thereafter, transmitting the VL3 frame towards the service VTEP throughthe L3 fabric.

Turning to FIG. 6C, in Step 640, after determining (in Step 608) thatthe source host (or source virtual machine) is a non-intercept host (orvirtual machine), another determination is made as to whether thedestination host (or destination virtual machine) is an intercept host(or virtual machine). Identification of the destination host as anintercept host may be determined based on one or more service policies(specified in redirect criteria (described above)) and headerinformation specified in the unicast MAC frame. For example, thedestination host may be recognized as an intercept host because thedestination host MAC address (specified in the header information of theunicast MAC frame) is tied to a service policy or rule specified in theredirect criteria. By way of another example, the destination host maybe recognized as an intercept host because the destination host IPaddress (specified in header information of the unicast MAC frame) istied to a service policy or rule specified in the redirect criteria.

In one embodiment of the invention, if it is determined that thedestination host (or destination virtual machine) is tied to any servicepolicy or rule specified in the redirect criteria, then the destinationhost (or destination virtual machine) is recognized as an intercepthost. Accordingly, based on this determination, the process may proceedto Step 642. On the other hand, in another embodiment of the invention,if it is alternatively determined that the destination host (ordestination virtual machine) is not tied to any service policy or rulespecified in the redirect criteria, then the destination host (ordestination virtual machine) is recognized as a non-intercept host (orvirtual machine). Accordingly, based on this determination, the processmay alternatively proceed to Step 652.

In Step 642, after determining (in Step 640) that the destination host(or destination virtual machine) is an intercept host/virtual machine, alookup is performed on an original VNI using the destination host (ordestination virtual machine) MAC address specified in header informationof the unicast MAC frame. In one embodiment of the invention, theoriginal VNI may identify with an original VL2 broadcast domain.Further, the original VL2 broadcast domain may be implemented as aunique, bidirectional overlay tunnel (e.g., a VXLAN tunnel) throughwhich network traffic, not sought for interception based on redirectcriteria, may traverse the L3 fabric towards a destination. Should anyhost MAC address be known on the original VNI, network traffic sourcedfrom and/or addressed to that host MAC address may be directed to a farnetwork interface (FNI) of a service VTEP, behind which the servicedevice may reside.

Moreover, in one embodiment of the invention, the above-mentioned lookupmay entail searching through one or more entries in a MAC-to-VNI tablefor an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 644, based on the lookup (performed in Step 642), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the original VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the original VNI, then the destinationhost/virtual machine MAC address is recognized as being known on theoriginal VNI. Accordingly, based on this determination, the process mayproceed to Step 646. On the other hand, in another embodiment of theinvention, if it is alternatively determined that an entry in theMAC-to-VNI table fails to map the destination host (or destinationvirtual machine) MAC address to at least the original VNI, then thedestination host/virtual machine MAC address is recognized as beingunknown on the original VNI. Accordingly, based on this determination,the process may alternatively proceed to Step 650.

In Step 646, after determining (in Step 644) that the destination host(or destination virtual machine) MAC address is known on the originalVNI, a network interface out of which the unicast MAC frame may betransmitted, towards the destination host/virtual machine, isidentified. In one embodiment of the invention, the aforementionednetwork interface, entailing either a physical or virtual networkinterface, may be identified through the performance of a lookup on aMAC address table using the destination host (or destination virtualmachine) MAC address. The MAC address table may refer to a datastructure that maintains one or more entries, where each entry not onlyspecifies out which network interface to forward network traffic, butalso through which overlay tunnel, if any, should the network traffic betransmitted through in order to reach their desired destination or anext hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through a certain network interface, leadingto a service VTEP, and using an overlay tunnel that implements theoriginal VL2 broadcast domain. Subsequently, the unicast MAC frame maybe encapsulated in a VL3 frame such as, for example, a VXLAN frame,where the VL3 frame may include header information that specifies, atleast in part, the original VNI.

In Step 648, the VL3 frame (obtained in Step 646) is transmitted,through an L3 fabric (see e.g., FIG. 1), towards the service VTEP.Specifically, in one embodiment of the invention, the VL3 frame maytraverse through an overlay tunnel—i.e., representative of the originalVL2 broadcast domain—that originates at the non-service VTEP (which hadobtained the unicast MAC frame in Step 600 or 602) and, subsequently,terminates at the service VTEP, behind which a service device resides.

In Step 650, after determining (in Step 644) that the destination host(or destination virtual machine) MAC address is unknown on the originalVNI, the unicast MAC frame is flooded to all destinations known on theoriginal VNI. In one embodiment of the invention, through MAC learningand/or the receipt of MAC programming instructions (MPIs) (describedabove), destinations known on the original VNI may include, but are notlimited to: the far network interface (FNI) of a service VTEP, behindwhich a service device may reside. Accordingly, a copy of the unicastMAC frame, intended to be flooded to the FNI of the service VTEP, may betransmitted thereto. In one embodiment of the invention, flooding of theunicast MAC frame to the FNI of the service VTEP may entailencapsulating the unicast MAC frame in a VL3 frame that specifies, atleast in part, the original VNI in header information and, thereafter,transmitting the VL3 frame towards the service VTEP through the L3fabric.

In Step 652, after determining (in Step 640) that the destination host(or destination virtual machine) is a non-intercept host/virtualmachine, the unicast MAC frame is transmitted towards the destinationhost/virtual machine using conventional routing and/or bridging.

FIGS. 7A-7C show flowcharts describing a method for receiving redirectedunicast network traffic within a zone in accordance with one or moreembodiments of the invention. The various steps outlined below may beperformed by a service virtual tunnel end point (VTEP) (i.e., a VTEPdirectly-connected to a service device). Further, while the varioussteps in the flowcharts are presented and described sequentially, one ofordinary skill will appreciate that some or all steps may be executed indifferent orders, may be combined or omitted, and some or all steps maybe executed in parallel.

Turning to FIG. 7A, in Step 700, a virtual layer-3 (VL3) frame isreceived. In one embodiment of the invention, the VL3 frame may haveoriginated from a remote, non-service VTEP. Further, the VL3 frame mayinclude or specify a forward-service virtual network identifier (VNI)within header information. The forward-service VNI may identify with aforward-service virtual layer-2 (VL2) broadcast domain. Moreover, theforward-service VL2 broadcast domain may be implemented as a unique,unidirectional overlay tunnel (e.g., a virtual extensible local areanetwork (VXLAN) tunnel) through which network traffic, intercepted basedon redirect criteria, may have been redirected to a service device forinspection.

In Step 702, the VL3 frame (received in Step 700) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a unicast media access control (MAC) frameenclosed therein. The unicast MAC frame may have originated from aremote, intercept host (or intercept virtual machine). Furthermore, theunicast MAC frame may include or specify a forward-service VL2 broadcastdomain tag (e.g., a forward-service virtual local area network (VLAN)tag). The forward-service VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith a forward-service VL2 broadcast domain. The forward-service VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In Step 704, a lookup is performed on a forward-service virtual networkidentifier (VNI) using a destination host (or destination virtualmachine) MAC address specified in header information of the unicast MACframe. In one embodiment of the invention, the forward-service VNI mayidentify with the forward-service VL2 broadcast domain. Should any hostMAC address be known on the forward-service VNI, network traffic sourcedfrom and/or addressed to that host MAC address may be redirected to anear network interface (NNI) of the service VTEP, behind which theservice device may reside.

Moreover, in one embodiment of the invention, the above-mentioned lookupmay entail searching through one or more entries in a MAC-to-VNI tablefor an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 706, based on the lookup (performed in Step 704), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the forward-service VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the forward-service VNI, then thedestination host/virtual machine MAC address is recognized as beingknown on the forward-service VNI. Accordingly, based on thisdetermination, the process may proceed to Step 720 (see e.g., FIG. 7B).On the other hand, in another embodiment of the invention, if it isalternatively determined that an entry in the MAC-to-VNI table fails tomap the destination host (or destination virtual machine) MAC address toat least the forward-service VNI, then the destination host/virtualmachine MAC address is recognized as being unknown on theforward-service VNI. Accordingly, based on this determination, theprocess may alternatively proceed to Step 740 (see e.g., FIG. 7C).

Turning to FIG. 7B, in Step 720, after determining (in Step 706) thatthe destination host (or destination virtual machine) MAC address isknown on the forward-service VNI, a network interface out of which theunicast MAC frame may be transmitted, towards the service device, isidentified. In one embodiment of the invention, the aforementionednetwork interface, entailing either a physical or virtual networkinterface, may be identified through the performance of a lookup on aMAC address table using the destination host (or destination virtualmachine) MAC address. The MAC address table may refer to a datastructure that maintains one or more entries, where each entry not onlyspecifies out which network interface to forward network traffic, butalso through which overlay tunnel, if any, should the network traffic betransmitted through in order to reach their desired destination or anext hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through the near network interface (NNI) ofthe service VTEP. Accordingly, based on this determination, the unicastMAC frame may be directed to the NNI of the service VTEP.

In Step 722, the unicast MAC frame is subsequently translated into theoriginal VL2 broadcast domain. In one embodiment of the invention, thistranslation may transpire because of a service-specific traffic flowrule (TFR) (described above)—e.g., dictating the translation of anyegress network traffic (i.e., the unicast MAC frame) traversing the NNIof the service VTEP from the forward-service VL2 broadcast domain to theoriginal VL2 broadcast domain. Furthermore, the aforementionedtranslation may entail replacing the forward-service VL2 broadcastdomain tag, specified in header information of the unicast MAC frame,with an original VL2 broadcast domain tag. The original VL2 broadcastdomain tag may include information that identifies the unicast MAC frameas being associated with the original VL2 broadcast domain. The originalVL2 broadcast domain tag may include additional information withoutdeparting from the scope of the invention. In Step 724, after thetranslation (performed in Step 722), the unicast MAC frame is bridgedacross the NNI of the service VTEP to a directly-connected servicedevice.

Turning to FIG. 7C, in Step 740, after determining (in Step 706) thatthe destination host (or destination virtual machine) MAC address isunknown on the forward-service VNI, the unicast MAC frame is flooded toall destinations known on the forward-service VNI. In one embodiment ofthe invention, through MAC learning and/or the receipt of MACprogramming instructions (MPIs) (described above), destinations known onthe forward-service VNI may include, but are not limited to: the NNI ofthe service VTEP, behind which a service device may reside. Accordingly,a copy of the unicast MAC frame may find its way to thedirectly-connected service device via traversal of the NNI of theservice VTEP.

FIGS. 8A-8C show flowcharts describing a method for receiving redirectedunicast network traffic within a zone in accordance with one or moreembodiments of the invention. The various steps outlined below may beperformed by a service virtual tunnel end point (VTEP) (i.e., a VTEPdirectly-connected to a service device). Further, while the varioussteps in the flowcharts are presented and described sequentially, one ofordinary skill will appreciate that some or all steps may be executed indifferent orders, may be combined or omitted, and some or all steps maybe executed in parallel.

Turning to FIG. 8A, in Step 800, a virtual layer-3 (VL3) frame isreceived. In one embodiment of the invention, the VL3 frame may haveoriginated from a remote, non-service VTEP. Further, the VL3 frame mayinclude or specify an original virtual network identifier (VNI) withinheader information. The original VNI may identify with an originalvirtual layer-2 (VL2) broadcast domain. Moreover, the original VL2broadcast domain may be implemented as a unique, bidirectional overlaytunnel (e.g., a VXLAN tunnel) through which network traffic, not soughtfor interception based on redirect criteria, may traverse the L3 fabrictowards a destination.

In Step 802, the VL3 frame (received in Step 800) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a unicast media access control (MAC) frameenclosed therein. The unicast MAC frame may have originated from aremote, non-intercept host (or non-intercept virtual machine).Furthermore, the unicast MAC frame may include or specify an originalVL2 broadcast domain tag (e.g., an original virtual local area network(VLAN) tag). The original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith the original VL2 broadcast domain. The original VL2 broadcastdomain tag may include additional information without departing from thescope of the invention.

In Step 804, a lookup is performed on an original virtual networkidentifier (VNI) using a destination host (or destination virtualmachine) MAC address specified in header information of the unicast MACframe. In one embodiment of the invention, the original VNI may identifywith the original VL2 broadcast domain. Should any host MAC address beknown on the original VNI, network traffic sourced from and/or addressedto that host MAC address may be redirected to a far network interface(FNI) of the service VTEP, behind which the service device may reside.

Moreover, in one embodiment of the invention, the above-mentioned lookupmay entail searching through one or more entries in a MAC-to-VNI tablefor an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 806, based on the lookup (performed in Step 804), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the original VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the original VNI, then the destinationhost/virtual machine MAC address is recognized as being known on theoriginal VNI. Accordingly, based on this determination, the process mayproceed to Step 820 (see e.g., FIG. 8B). On the other hand, in anotherembodiment of the invention, if it is alternatively determined that anentry in the MAC-to-VNI table fails to map the destination host (ordestination virtual machine) MAC address to at least the original VNI,then the destination host/virtual machine MAC address is recognized asbeing unknown on the original VNI. Accordingly, based on thisdetermination, the process may alternatively proceed to Step 840 (seee.g., FIG. 8C).

Turning to FIG. 8B, in Step 820, after determining (in Step 806) thatthe destination host (or destination virtual machine) MAC address isknown on the original VNI, a network interface out of which the unicastMAC frame may be transmitted, towards the service device, is identified.In one embodiment of the invention, the aforementioned networkinterface, entailing either a physical or virtual network interface, maybe identified through the performance of a lookup on a MAC address tableusing the destination host (or destination virtual machine) MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through the FNI of the service VTEP.Accordingly, based on this determination, the unicast MAC frame may bedirected to the FNI of the service VTEP. Thereafter, in Step 822, theunicast MAC frame is subsequently bridged across the FNI of the serviceVTEP to a directly-connected service device.

Turning to FIG. 8C, in Step 840, after determining (in Step 806) thatthe destination host (or destination virtual machine) MAC address isunknown on the original VNI, the unicast MAC frame is flooded to alldestinations known on the original VNI. In one embodiment of theinvention, through MAC learning and/or the receipt of MAC programminginstructions (MPIs) (described above), destinations known on theoriginal VNI may include, but are not limited to: the FNI of the serviceVTEP, behind which a service device may reside. Accordingly, a copy ofthe unicast MAC frame may find its way to the directly-connected servicedevice via traversal of the FNI of the service VTEP.

FIGS. 9A-9C show flowcharts describing a method for transmittinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention. The various steps outlined belowmay be performed by a service virtual tunnel end point (VTEP) (i.e., aVTEP directly-connected to a service device). Further, while the varioussteps in the flowcharts are presented and described sequentially, one ofordinary skill will appreciate that some or all steps may be executed indifferent orders, may be combined or omitted, and some or all steps maybe executed in parallel.

Turning to FIG. 9A, in Step 900, a unicast media access control (MAC)frame is received. In one embodiment of the invention, a unicast MACframe may refer to a MAC frame addressed to a single destination host(or destination virtual machine). Further, the unicast MAC frame mayhave been generated and transmitted by, and thus, may have originatedfrom a directly-connected source host (or source virtual machine).Moreover, in one embodiment of the invention, the unicast MAC frame mayinclude or specify an original virtual layer-2 (VL2) broadcast domaintag (e.g., an original virtual local area network (VLAN) tag). Theoriginal VL2 broadcast domain tag may include information thatidentifies the unicast MAC frame as being associated with an originalVL2 broadcast domain (e.g., an original VLAN). The original VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In another embodiment of the invention, in Step 902, a unicast MAC framelacking a VL2 broadcast domain tag may be received. Accordingly, theunicast MAC frame may be received untagged. In such an embodiment, basedon identifying that the unicast MAC frame is untagged, in Step 904, anetwork interface configuration (NIC) for the network interface, throughwhich the untagged unicast MAC frame had been received, is accessed. Inone embodiment of the invention, the NIC for the network interface maytrack various properties (or attributes) associated with the networkinterface. By way an example, the NIC for the network interface maytrack a membership property (or attribute) belonging to the networkinterface, which may identify one or more virtual network identifiers(VNIs), including a default VNI, of which the network interface may beenrolled as a member.

In Step 906, from the NIC (accessed in Step 904), the default VNI ofwhich the network interface (i.e., through which the untagged unicastMAC frame had been received) is a member is identified. Specifically, asmentioned above, the default VNI may be identified by examining amembership property (or attribute) disclosed in the NIC of the networkinterface. Further, the default VNI may subsequently identify thecorresponding default VL2 broadcast domain with which the default VNI isassociated. Accordingly, in one embodiment of the invention, theidentified default VNI for the network interface may identify theoriginal VL2 broadcast domain as the default VL2 broadcast domainassociated with the default VNI. In one or more other embodiments of theinvention, the identified default VNI for the network interface mayalternatively identify any other VL2 broadcast domain as the default VL2broadcast domain associated with the default VNI. Hereinafter, theheader field of the unicast MAC frame associated with the VL2 broadcastdomain tag may subsequently be modified to include the default VL2broadcast domain tag (e.g., the original VL2 broadcast domain tag).

In Step 908, after receipt of the unicast MAC frame (either in Step 900or through Steps 902 to 906), a determination is made as to whether thesource host is an intercept host. In one embodiment of the invention, anintercept host may refer to a host where network traffic therefromand/or thereto may be intercepted and inspected by a service device.Identification of the source host as an intercept host may be determinedbased on one or more service policies (specified in redirect criteria(described above)) and header information specified in the unicast MACframe. For example, the source host may be recognized as an intercepthost because the source host MAC address (specified in the headerinformation of the unicast MAC frame) is tied to a service policy orrule specified in the redirect criteria. By way of another example, thesource host may be recognized as an intercept host because the sourcehost IP address (specified in header information of the unicast MACframe) is tied to a service policy or rule specified in the redirectcriteria.

In one embodiment of the invention, if it is determined that the sourcehost (or source virtual machine) is tied to any service policy or rulespecified in the redirect criteria, then the source host (or sourcevirtual machine) is recognized as an intercept host. Accordingly, basedon this determination, the process may proceed to Step 920 (see e.g.,FIG. 9B). On the other hand, in another embodiment of the invention, ifit is alternatively determined that the source host (or source virtualmachine) is not tied to any service policy or rule specified in theredirect criteria, then the source host (or source virtual machine) isrecognized as a non-intercept host (or virtual machine). Accordingly,based on this determination, the process may alternatively proceed toStep 940 (see e.g., FIG. 9C).

Turning to FIG. 9B, in Step 920, after determining (in Step 908) thatthe source host (or source virtual machine) is an intercept host (orvirtual machine), the unicast MAC frame (received in Step 900 or 902) istranslated into the forward-service VL2 broadcast domain. In oneembodiment of the invention, this translation may transpire because ofan intercept-specific traffic flow rule (TFR) (described above)—e.g.,dictating the translation of any ingress network traffic (i.e., theunicast MAC frame) traversing an intercept network interface (INI) (seee.g., FIG. 2) of an intercept VTEP from the original VL2 broadcastdomain to the forward-service VL2 broadcast domain, where the source MACaddress specified in the ingress network traffic is associated with anintercept host. Furthermore, the aforementioned translation may entailreplacing the original VL2 broadcast domain tag, specified in headerinformation of the unicast MAC frame, with a forward-service VL2broadcast domain tag. The forward-service VL2 broadcast domain tag mayinclude information that identifies the unicast MAC frame as beingassociated with a forward-service VL2 broadcast domain. Theforward-service VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.

In Step 922, a lookup is performed on a forward-service virtual networkidentifier (VNI) using a destination host (or destination virtualmachine) MAC address specified in header information of the unicast MACframe. In one embodiment of the invention, the forward-service VNI mayidentify with a forward-service VL2 broadcast domain. Further, theforward-service VL2 broadcast domain may be implemented as a unique,unidirectional overlay tunnel (e.g., a virtual extensible local areanetwork (VXLAN) tunnel) through which network traffic, intercepted basedon redirect criteria, may be redirected to a service device forinspection. Should any host MAC address be known on the forward-serviceVNI, network traffic sourced from and/or addressed to that host MACaddress may be redirected to a near network interface (NNI) of theservice VTEP, behind which the service device may reside.

Moreover, in one embodiment of the invention, the above-mentioned lookupmay entail searching through one or more entries in a MAC-to-VNI tablefor an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 924, based on the lookup (performed in Step 922), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the forward-service VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the forward-service VNI, then thedestination host/virtual machine MAC address is recognized as beingknown on the forward-service VNI. Accordingly, based on thisdetermination, the process may proceed to Step 926. On the other hand,in another embodiment of the invention, if it is alternativelydetermined that an entry in the MAC-to-VNI table fails to map thedestination host (or destination virtual machine) MAC address to atleast the forward-service VNI, then the destination host/virtual machineMAC address is recognized as being unknown on the forward-service VNI.Accordingly, based on this determination, the process may alternativelyproceed to Step 932.

In Step 926, after determining (in Step 924) that the destination host(or destination virtual machine) MAC address is known on theforward-service VNI, a network interface out of which the unicast MACframe may be transmitted, towards the service device, is identified. Inone embodiment of the invention, the aforementioned network interface,entailing either a physical or virtual network interface, may beidentified through the performance of a lookup on a MAC address tableusing the destination host (or destination virtual machine) MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through the near network interface (NNI) ofthe service VTEP. Accordingly, based on this determination, the unicastMAC frame may be directed to the NNI of the service VTEP.

In Step 928, the unicast MAC frame is subsequently translated into theoriginal VL2 broadcast domain. In one embodiment of the invention, thistranslation may transpire because of a service-specific traffic flowrule (TFR) (described above)—e.g., dictating the translation of anyegress network traffic (i.e., the unicast MAC frame) traversing the NNIof the service VTEP from the forward-service VL2 broadcast domain to theoriginal VL2 broadcast domain. Furthermore, the aforementionedtranslation may entail replacing the forward-service VL2 broadcastdomain tag, specified in header information of the unicast MAC frame,with an original VL2 broadcast domain tag. The original VL2 broadcastdomain tag may include information that identifies the unicast MAC frameas being associated with the original VL2 broadcast domain. The originalVL2 broadcast domain tag may include additional information withoutdeparting from the scope of the invention. In Step 930, after thetranslation (performed in Step 928), the unicast MAC frame is bridgedacross the NNI of the service VTEP to a directly-connected servicedevice.

In Step 932, after determining (in Step 924) that the destination host(or destination virtual machine) MAC address is unknown on theforward-service VNI, the unicast MAC frame is flooded to alldestinations known on the forward-service VNI. In one embodiment of theinvention, through MAC learning and/or the receipt of MAC programminginstructions (MPIs) (described above), destinations known on theforward-service VNI may include, but are not limited to: (i) the nearnetwork interface (NNI) of a service VTEP, behind which a service devicemay reside; and (ii) at least one intercept network interface (INI) (seee.g., FIG. 2) of one or more intercept VTEPs, behind which at least oneintercept host (or intercept virtual machine) may reside. Furthermore,based on the imposition of intercept-specific traffic flow rules (TFRs),copies of the unicast MAC frame, intended to be flooded to the at leastone INI of one or more intercept VTEPs, may be dropped in order toreduce duplicate network traffic delivery. Accordingly, just a copy ofthe unicast MAC frame may find its way to the directly-connected servicedevice via traversal of the NNI of the service VTEP.

Turning to FIG. 9C, in Step 940, after determining (in Step 908) thatthe source host (or source virtual machine) is a non-intercept host (orvirtual machine), another determination is made as to whether thedestination host (or destination virtual machine) is an intercept host(or virtual machine). Identification of the destination host as anintercept host may be determined based on one or more service policies(specified in redirect criteria (described above)) and headerinformation specified in the unicast MAC frame. For example, thedestination host may be recognized as an intercept host because thedestination host MAC address (specified in the header information of theunicast MAC frame) is tied to a service policy or rule specified in theredirect criteria. By way of another example, the destination host maybe recognized as an intercept host because the destination host IPaddress (specified in header information of the unicast MAC frame) istied to a service policy or rule specified in the redirect criteria.

In one embodiment of the invention, if it is determined that thedestination host (or destination virtual machine) is tied to any servicepolicy or rule specified in the redirect criteria, then the destinationhost (or destination virtual machine) is recognized as an intercepthost. Accordingly, based on this determination, the process may proceedto Step 942. On the other hand, in another embodiment of the invention,if it is alternatively determined that the destination host (ordestination virtual machine) is not tied to any service policy or rulespecified in the redirect criteria, then the destination host (ordestination virtual machine) is recognized as a non-intercept host (orvirtual machine). Accordingly, based on this determination, the processmay alternatively proceed to Step 952.

In Step 942, after determining (in Step 940) that the destination host(or destination virtual machine) is an intercept host/virtual machine, alookup is performed on an original VNI using the destination host (ordestination virtual machine) MAC address specified in header informationof the unicast MAC frame. In one embodiment of the invention, theoriginal VNI may identify with an original VL2 broadcast domain.Further, the original VL2 broadcast domain may be implemented as aunique, bidirectional overlay tunnel (e.g., a VXLAN tunnel) throughwhich network traffic, not sought for interception based on redirectcriteria, may traverse the L3 fabric towards a destination. Should anyhost MAC address be known on the original VNI, network traffic sourcedfrom and/or addressed to that host MAC address may be directed to a farnetwork interface (FNI) of a service VTEP, behind which the servicedevice may reside.

Moreover, in one embodiment of the invention, the above-mentioned lookupmay entail searching through one or more entries in a MAC-to-VNI tablefor an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 944, based on the lookup (performed in Step 942), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the original VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the original VNI, then the destinationhost/virtual machine MAC address is recognized as being known on theoriginal VNI. Accordingly, based on this determination, the process mayproceed to Step 946. On the other hand, in another embodiment of theinvention, if it is alternatively determined that an entry in theMAC-to-VNI table fails to map the destination host (or destinationvirtual machine) MAC address to at least the original VNI, then thedestination host/virtual machine MAC address is recognized as beingunknown on the original VNI. Accordingly, based on this determination,the process may alternatively proceed to Step 950.

In Step 946, after determining (in Step 944) that the destination host(or destination virtual machine) MAC address is known on the originalVNI, a network interface out of which the unicast MAC frame may betransmitted, towards the service device, is identified. In oneembodiment of the invention, the aforementioned network interface,entailing either a physical or virtual network interface, may beidentified through the performance of a lookup on a MAC address tableusing the destination host (or destination virtual machine) MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through the FNI of the service VTEP.Accordingly, based on this determination, the unicast MAC frame may bedirected to the FNI of the service VTEP. Thereafter, in Step 948, theunicast MAC frame is subsequently bridged across the FNI of the serviceVTEP to a directly-connected service device.

In Step 950, after determining (in Step 944) that the destination host(or destination virtual machine) MAC address is unknown on the originalVNI, the unicast MAC frame is flooded to all destinations known on theoriginal VNI. In one embodiment of the invention, through MAC learningand/or the receipt of MAC programming instructions (MPIs) (describedabove), destinations known on the original VNI may include, but are notlimited to: the FNI of the service VTEP, behind which a service devicemay reside. Accordingly, a copy of the unicast MAC frame may find itsway to the directly-connected service device via traversal of the FNI ofthe service VTEP.

In Step 952, after determining (in Step 940) that the destination host(or destination virtual machine) is a non-intercept host/virtualmachine, the unicast MAC frame is transmitted towards the destinationhost/virtual machine using conventional routing and/or bridging.

FIG. 10A-10D show flowcharts describing a method for transmittinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention. The various steps outlined belowmay be performed by a service virtual tunnel end point (VTEP) (i.e., aVTEP directly-connected to a service device). Further, while the varioussteps in the flowcharts are presented and described sequentially, one ofordinary skill will appreciate that some or all steps may be executed indifferent orders, may be combined or omitted, and some or all steps maybe executed in parallel.

Turning to FIG. 10A, in Step 1000, a unicast media access control (MAC)frame is received from a directly-connected service device. In oneembodiment of the invention, the unicast MAC frame may arrive through afar network interface (FNI) (see e.g., FIG. 2) of the service VTEP.Further, the unicast MAC frame may include or specify an originalvirtual layer-2 (VL2) broadcast domain tag within its L2 headerinformation. The original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith an original VL2 broadcast domain. The original VL2 broadcast domaintag may include additional information without departing from the scopeof the invention.

In Step 1002, a unicast MAC frame copy is obtained through portmirroring. In one embodiment of the invention, port mirroring may referto the replication of network traffic seen on one network interface toyield a copy of that network traffic, which may then be directed toanother network interface. Furthermore, the port mirroring may transpirebecause of a service-specific network interface configuration (NIC)(described above)—e.g., dictating the configuration of a mirroringproperty (or attribute) belonging to the FNI of the service VTEP suchthat the FNI mirrors any ingress network traffic at the FNI to theloop-start interface (LSI) (see e.g., FIG. 2) of the service VTEP.Accordingly, in Step 1004, based on the aforementioned service-specificNIC, the unicast MAC frame copy (obtained in Step 1002) is directed tothe LSI of the service VTEP.

In Step 1006, a lookup is performed on an original VNI using thedestination host (or destination virtual machine) MAC address specifiedin header information of the unicast MAC frame. In one embodiment of theinvention, the original VNI may identify with the original VL2 broadcastdomain. Moreover, in one embodiment of the invention, the aforementionedlookup may entail searching through one or more entries in a MAC-to-VNItable for an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 1008, based on the lookup (performed in Step 1006), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the original VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the original VNI, then the destinationhost/virtual machine MAC address is recognized as being known on theoriginal VNI. Accordingly, based on this determination, the process mayproceed to Step 1020 (see e.g., FIG. 10B). On the other hand, in anotherembodiment of the invention, if it is alternatively determined that anentry in the MAC-to-VNI table fails to map the destination host (ordestination virtual machine) MAC address to at least the original VNI,then the destination host/virtual machine MAC address is recognized asbeing unknown on the original VNI. Accordingly, based on thisdetermination, the process may alternatively proceed to Step 1040 (seee.g., FIG. 10C).

Turning to FIG. 10B, in Step 1020, after determining (in Step 1008) thatdestination host (or destination virtual machine) MAC address is knownon the original VNI, another determination is made as to whether thedestination host/virtual machine is an intercept host (or interceptvirtual machine). Identification of the destination host as an intercepthost may be determined based on one or more service policies (specifiedin redirect criteria (described above)) and header information specifiedin the unicast MAC frame. For example, the destination host may berecognized as an intercept host because the destination host MAC address(specified in the header information of the unicast MAC frame) is tiedto a service policy or rule specified in the redirect criteria. By wayof another example, the destination host may be recognized as anintercept host because the destination host IP address (specified inheader information of the unicast MAC frame) is tied to a service policyor rule specified in the redirect criteria.

In one embodiment of the invention, if it is determined that thedestination host (or destination virtual machine) is tied to any servicepolicy or rule specified in the redirect criteria, then the destinationhost (or destination virtual machine) is recognized as an intercepthost. Accordingly, based on this determination, the process may proceedto Step 1022. On the other hand, in another embodiment of the invention,if it is alternatively determined that the destination host (ordestination virtual machine) is not tied to any service policy or rulespecified in the redirect criteria, then the destination host (ordestination virtual machine) is recognized as a non-intercept host (orvirtual machine). Accordingly, based on this determination, the processmay alternatively proceed to Step 1024.

In Step 1022, after determining (in Step 1020) that the destination host(or destination virtual machine) is an intercept host/virtual machine, anetwork interface out of which the unicast MAC frame may be transmitted,towards the destination host/virtual machine, is identified. In oneembodiment of the invention, the aforementioned network interface,entailing either a physical or virtual network interface, may beidentified through the performance of a lookup on a MAC address tableusing the destination host (or destination virtual machine) MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through the FNI of the service VTEP. Thismay be the case because, as an intercept host/virtual machine, thedestination host/virtual machine may have been programmed behind the FNIof the service VTEP per an earlier processed MAC programming instruction(MPI)—e.g., any and all intercept host (or intercept virtual machine)MAC address(es), on the original VNI, are to be programmed behind theFNI of a service VTEP. However, because the unicast MAC frame is alreadyat the FNI of the service VTEP, the unicast MAC frame is subsequentlydropped. Hereinafter, the process may proceed to Step 1040 (see e.g.,FIG. 10C).

In Step 1024, after determining (in Step 1020) that the destination host(or destination virtual machine) is a non-intercept host/virtualmachine, another determination is made as to whether the destinationhost/virtual machine is directly-connected. In one embodiment of theinvention, identifying whether the destination host/virtual machine isdirectly-connected may entail performing a lookup on a MAC address tableusing the destination host/virtual machine MAC address specified inheader information of the unicast MAC frame. In one embodiment of theinvention, if it is determined, based on the aforementioned lookup onthe MAC address table, that the destination host/virtual machine isdirectly-connected, the process may proceed to Step 1026. On the otherhand, in another embodiment of the invention, if it is alternativelydetermined, based on the lookup, that the destination host/virtualmachine is not directly-connected (i.e., indicative of a remotedestination), the process may alternatively proceed to Step 1028.

In Step 1026, after determining (in Step 1024) that the destination host(or destination virtual machine) is directly-connected, the unicast MACframe is bridged. More specifically, in one embodiment of the invention,the unicast MAC frame may be bridged from the service VTEP, via acertain network interface specified in an entry in the MAC addresstable, to the directly-connected destination host/virtual machine.Hereinafter, the process may proceed to Step 1040 (see e.g., FIG. 10C).

In Step 1028, after determining (in Step 1024) that the destination host(or destination virtual machine) is not directly-connected, an entry inthe MAC address table may specify that the unicast MAC frame should betransmitted through a certain network interface, leading to a remoteVTEP, and using an overlay tunnel that implements the original VL2broadcast domain. Subsequently, the unicast MAC frame may beencapsulated in a VL3 frame such as, for example, a VXLAN frame, wherethe VL3 frame may include header information that specifies, at least inpart, the original VNI.

In Step 1030, the VL3 frame (obtained in Step 1028) is transmitted,through an L3 fabric (see e.g., FIG. 1), towards the remote VTEP.Specifically, in one embodiment of the invention, the VL3 frame maytraverse through an overlay tunnel—i.e., representative of the originalVL2 broadcast domain—that originates at the service VTEP (which hadobtained the unicast MAC frame in Step 1000) and, subsequently,terminates at the remote VTEP, behind which the destination host/virtualmachine resides. Hereinafter, the process may proceed to Step 1040 (seee.g., FIG. 10C).

Turning to FIG. 10C, in Step 1040, after the unicast MAC frame copy isdirected to the LSI of the service VTEP (in Step 1004), the unicast MACframe copy is received at a loop-end interface (LEI) (see e.g., FIG. 2)of the service VTEP. In one embodiment of the invention, the LSI and theLEI may be connected together using a physical loopback cable.Accordingly, any egress network traffic traversing the LSI becomesingress network traffic arriving at the LEI.

In Step 1042, the unicast MAC frame copy is translated into thereverse-service VL2 broadcast domain. In one embodiment of theinvention, this translation may transpire because of a service-specifictraffic flow rule (TFR) (described above)—e.g., dictating thetranslation of any ingress network traffic (i.e., the unicast MAC framecopy) traversing the LEI of the service VTEP from the original VL2broadcast domain to the reverse-service VL2 broadcast domain.Furthermore, the aforementioned translation may entail replacing theoriginal VL2 broadcast domain tag, specified in header information ofthe unicast MAC frame copy, with a reverse-service VL2 broadcast domaintag. The reverse-service VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame copy as beingassociated with a reverse-service VL2 broadcast domain. Thereverse-service VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.

In Step 1044, a lookup is performed on a reverse-service virtual networkidentifier (VNI) using a destination host (or destination virtualmachine) MAC address specified in header information of the unicast MACframe copy. In one embodiment of the invention, the reverse-service VNImay identify with a reverse-service VL2 broadcast domain. Further, thereverse-service VL2 broadcast domain may be implemented as a unique,unidirectional overlay tunnel (e.g., a virtual extensible local areanetwork (VXLAN) tunnel) through which network traffic, addressed to anintercept host/virtual machine, may be directed thereto afterinspection.

Moreover, in one embodiment of the invention, the above-mentioned lookupmay entail searching through one or more entries in a MAC-to-VNI tablefor an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 1046, based on the lookup (performed in Step 1044), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the reverse-service VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the reverse-service VNI, then thedestination host/virtual machine MAC address is recognized as beingknown on the reverse-service VNI. Accordingly, based on thisdetermination, the process may proceed to Step 1060 (see e.g., FIG.10D). On the other hand, in another embodiment of the invention, if itis alternatively determined that an entry in the MAC-to-VNI table failsto map the destination host (or destination virtual machine) MAC addressto at least the reverse-service VNI, then the destination host/virtualmachine MAC address is recognized as being unknown on thereverse-service VNI. Accordingly, based on this determination, theprocess may alternatively proceed to Step 1048.

In Step 1048, after determining (in Step 1046) that the destination host(or destination virtual machine) MAC address is unknown on thereverse-service VNI, the unicast MAC frame copy is dropped. This may bethe case because, in one embodiment of the invention, a service-specificnetwork interface configuration (NIC) (described above) may havepreviously configured a flooding property (or attribute) belonging tothe LEI of the service VTEP such that unknown unicast flooding at theLEI is disabled.

Turning to FIG. 10D, in Step 1060, after determining (in Step 1046) thatthe destination host (or destination virtual machine) MAC address isknown on the reverse-service VNI, another determination is made as towhether the destination host/virtual machine is directly-connected. Inone embodiment of the invention, identifying whether the destinationhost/virtual machine is directly-connected may entail performing alookup on a MAC address table using the destination host/virtual machineMAC address specified in header information of the unicast MAC framecopy. In one embodiment of the invention, if it is determined, based onthe aforementioned lookup on the MAC address table, that the destinationhost/virtual machine is directly-connected, the process may proceed toStep 1062. On the other hand, in another embodiment of the invention, ifit is alternatively determined, based on the lookup, that thedestination host/virtual machine is not directly-connected (i.e.,indicative of a remote destination), the process may alternativelyproceed to Step 1066.

In Step 1062, after determining (in Step 1060) that the destination host(or destination virtual machine) is directly-connected, the unicast MACframe copy is translated into the original VL2 broadcast domain. In oneembodiment of the invention, this translation may transpire because ofan intercept-specific traffic flow rule (TFR) (described above)—e.g.,dictating the translation of any egress network traffic (i.e., theunicast MAC frame copy) traversing an intercept network interface (INI)of an intercept VTEP (i.e., which the service VTEP also is in this case)from the reverse-service VL2 broadcast domain to the original VL2broadcast domain. Furthermore, the aforementioned translation may entailreplacing the reverse-service VL2 broadcast domain tag, specified inheader information of the unicast MAC frame copy, with an original VL2broadcast domain tag. The original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame copy as beingassociated with the original VL2 broadcast domain. The original VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention. Thereafter, in Step 1064, theunicast MAC frame copy is bridged across an INI of the service(intercept) VTEP to the directly-connected destination host (ordestination virtual machine).

In Step 1066, after determining (in Step 1060) that the destination host(or destination virtual machine) is not directly-connected, an entry inthe MAC address table may specify that the unicast MAC frame copy shouldbe transmitted through a certain network interface, leading to a remoteVTEP, and using an overlay tunnel that implements the reverse-serviceVL2 broadcast domain. Subsequently, the unicast MAC frame may beencapsulated in a VL3 frame such as, for example, a VXLAN frame, wherethe VL3 frame may include header information that specifies, at least inpart, the reverse-service VNI.

In Step 1068, the VL3 frame (obtained in Step 1066) is transmitted,through an L3 fabric (see e.g., FIG. 1), towards the remote VTEP.Specifically, in one embodiment of the invention, the VL3 frame maytraverse through an overlay tunnel—i.e., representative of thereverse-service VL2 broadcast domain—that originates at the service VTEPand, subsequently, terminates at the remote VTEP, behind which thedestination host/virtual machine resides.

FIGS. 11A and 11B show flowcharts describing a method for transmittinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention. The various steps outlined belowmay be performed by a service virtual tunnel end point (VTEP) (i.e., aVTEP directly-connected to a service device). Further, while the varioussteps in the flowcharts are presented and described sequentially, one ofordinary skill will appreciate that some or all steps may be executed indifferent orders, may be combined or omitted, and some or all steps maybe executed in parallel.

Turning to FIG. 11A, in Step 1100, a unicast media access control (MAC)frame is received from a directly-connected service device. In oneembodiment of the invention, the unicast MAC frame may arrive through anear network interface (NNI) (see e.g., FIG. 2) of the service VTEP.Further, the unicast MAC frame may include or specify an originalvirtual layer-2 (VL2) broadcast domain tag within its L2 headerinformation. The original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith an original VL2 broadcast domain. The original VL2 broadcast domaintag may include additional information without departing from the scopeof the invention.

In Step 1102, the unicast MAC frame is translated into thereverse-service VL2 broadcast domain. In one embodiment of theinvention, this translation may transpire because of a service-specifictraffic flow rule (TFR) (described above)—e.g., dictating thetranslation of any egress network traffic (i.e., the unicast MAC frame)traversing the NNI of the service VTEP from the original VL2 broadcastdomain to the reverse-service VL2 broadcast domain. Furthermore, theaforementioned translation may entail replacing the original VL2broadcast domain tag, specified in header information of the unicast MACframe, with a reverse-service VL2 broadcast domain tag. Thereverse-service VL2 broadcast domain tag may include information thatidentifies the unicast MAC frame as being associated with thereverse-service VL2 broadcast domain. The reverse-service VL2 broadcastdomain tag may include additional information without departing from thescope of the invention.

In Step 1104, the source host (or source virtual machine) MAC address,specified in header information of the unicast MAC frame, is learned onthe reverse-service VL2 broadcast domain at the NNI of the service VTEP.Based on this learning, in Step 1106, a MAC address table of the serviceVTEP is updated. Specifically, in one embodiment of the invention, theMAC address table may be updated to include an entry that specifies thesource host/virtual machine MAC address, the reverse-service VL2broadcast domain ID, and a NNI ID associated with the NNI of the serviceVTEP. Furthermore, based on a service-specific network interfaceconfiguration (NIC) (described above), any host/virtual machine MACaddresses learned on the reverse-service VL2 broadcast domain are to becopied to the forward-service VL2 broadcast domain. Accordingly, the MACaddress table may be further updated to include an entry that specifiesthe source host/virtual machine MAC address, the forward-service VL2broadcast domain ID, and the aforementioned NNI ID associated with theNNI of the service VTEP.

In Step 1108, after translating the unicast MAC frame into thereverse-service VL2 broadcast domain (in Step 1102), a lookup isperformed on a reverse-service virtual network identifier (VNI) using adestination host (or destination virtual machine) MAC address specifiedin header information of the unicast MAC frame. In one embodiment of theinvention, the reverse-service VNI may identify with the reverse-serviceVL2 broadcast domain. Further, the reverse-service VL2 broadcast domainmay be implemented as a unique, unidirectional overlay tunnel (e.g., avirtual extensible local area network (VXLAN) tunnel) through whichnetwork traffic, addressed to an intercept host/virtual machine, may bedirected thereto after inspection.

Turning to FIG. 11B, in Step 1120, based on the lookup (performed inStep 1108), a determination is made as to whether the destination host(or destination virtual machine) MAC address is known on thereverse-service VNI. In one embodiment of the invention, if it isdetermined that an entry in the MAC-to-VNI table maps the destinationhost (or destination virtual machine) MAC address to at least thereverse-service VNI, then the destination host/virtual machine MACaddress is recognized as being known on the reverse-service VNI.Accordingly, based on this determination, the process may proceed toStep 1122. On the other hand, in another embodiment of the invention, ifit is alternatively determined that an entry in the MAC-to-VNI tablefails to map the destination host (or destination virtual machine) MACaddress to at least the reverse-service VNI, then the destinationhost/virtual machine MAC address is recognized as being unknown on thereverse-service VNI. Accordingly, based on this determination, theprocess may alternatively proceed to Step 1132.

In Step 1122, after determining (in Step 1120) that the destination host(or destination virtual machine) MAC address is known on thereverse-service VNI, another determination is made as to whether thedestination host/virtual machine is directly-connected. In oneembodiment of the invention, identifying whether the destinationhost/virtual machine is directly-connected may entail performing alookup on a MAC address table using the destination host/virtual machineMAC address specified in header information of the unicast MAC frame. Inone embodiment of the invention, if it is determined, based on theaforementioned lookup on the MAC address table, that the destinationhost/virtual machine is directly-connected, the process may proceed toStep 1124. On the other hand, in another embodiment of the invention, ifit is alternatively determined, based on the lookup, that thedestination host/virtual machine is not directly-connected (i.e.,indicative of a remote destination), the process may alternativelyproceed to Step 1128.

In Step 1124, after determining (in Step 1122) that the destination host(or destination virtual machine) is directly-connected, the unicast MACframe is translated into the original VL2 broadcast domain. In oneembodiment of the invention, this translation may transpire because ofan intercept-specific traffic flow rule (TFR) (described above)—e.g.,dictating the translation of any egress network traffic (i.e., theunicast MAC frame copy) traversing an intercept network interface (INI)of an intercept VTEP (i.e., which the service VTEP also is in this case)from the reverse-service VL2 broadcast domain to the original VL2broadcast domain. Furthermore, the aforementioned translation may entailreplacing the reverse-service VL2 broadcast domain tag, specified inheader information of the unicast MAC frame, with an original VL2broadcast domain tag. The original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith the original VL2 broadcast domain. The original VL2 broadcastdomain tag may include additional information without departing from thescope of the invention. Thereafter, in Step 1126, the unicast MAC frameis bridged across an INI of the service (intercept) VTEP to thedirectly-connected destination host (or destination virtual machine).

In Step 1128, after determining (in Step 1122) that the destination host(or destination virtual machine) is not directly-connected, an entry inthe MAC address table may specify that the unicast MAC frame should betransmitted through a certain network interface, leading to a remoteVTEP, and using an overlay tunnel that implements the reverse-serviceVL2 broadcast domain. Subsequently, the unicast MAC frame may beencapsulated in a VL3 frame such as, for example, a VXLAN frame, wherethe VL3 frame may include header information that specifies, at least inpart, the reverse-service VNI.

In Step 1130, the VL3 frame (obtained in Step 1128) is transmitted,through an L3 fabric (see e.g., FIG. 1), towards the remote VTEP.Specifically, in one embodiment of the invention, the VL3 frame maytraverse through an overlay tunnel—i.e., representative of thereverse-service VL2 broadcast domain—that originates at the service VTEPand, subsequently, terminates at the remote VTEP, behind which thedestination host/virtual machine resides.

In Step 1132, after determining (in Step 1120) that the destination host(or destination virtual machine) is unknown on the reverse-service VNI,the unicast MAC frame is flooded to all destinations known on thereverse-service VNI. In one embodiment of the invention, through MAClearning and/or the receipt of MAC programming instructions (MPIs)(described above), destinations known on the reverse-service VNI mayinclude, but are not limited to: at least one intercept networkinterface (INI) (see e.g., FIG. 2) of one or more intercept VTEPs,behind which at least one intercept host (or intercept virtual machine)may reside. Accordingly, a copy of the unicast MAC frame may find itsway to the destination host/virtual machine, which may or may bedirectly-connected.

FIG. 12 shows a flowchart describing a method for receiving inspectedunicast network traffic within a zone in accordance with one or moreembodiments of the invention. The various steps outlined below may beperformed by a non-service virtual tunnel end point (VTEP) (i.e., a VTEPnot directly-connected to a service device (or a remote VTEP)). Further,while the various steps in the flowcharts are presented and describedsequentially, one of ordinary skill will appreciate that some or allsteps may be executed in different orders, may be combined or omitted,and some or all steps may be executed in parallel.

Turning to FIG. 12, in Step 1200, a virtual layer-3 (VL3) frame isreceived. In one embodiment of the invention, the VL3 frame may haveoriginated from a service VTEP. Further, the VL3 frame may include orspecify an original virtual network identifier (VNI) within headerinformation. The original VNI may identify with an original virtuallayer-2 (VL2) broadcast domain.

In Step 1202, the VL3 frame (received in Step 1200) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a unicast media access control (MAC) frameenclosed therein. The unicast MAC frame may have originated from aintercept source host (or intercept source virtual machine). The unicastMAC frame may also be addressed to a non-intercept destination host (ornon-intercept destination virtual machine). Furthermore, the unicast MACframe may include or specify an original VL2 broadcast domain tag (e.g.,an original virtual local area network (VLAN) tag). The original VL2broadcast domain tag may include information that identifies the unicastMAC frame as being associated with the original VL2 broadcast domain.The original VL2 broadcast domain tag may include additional informationwithout departing from the scope of the invention.

In Step 1204, a lookup is performed on the original VNI using thenon-intercept destination host (or non-intercept destination virtualmachine) MAC address specified in header information of the unicast MACframe. In one embodiment of the invention, the aforementioned lookup mayentail searching through one or more entries in a MAC-to-VNI table foran entry that specifies at least the non-intercept destination host (ornon-intercept destination virtual machine) MAC address. Theaforementioned MAC-to-VNI table may maintain one or more entries, whereeach entry may include or specify one MAC address and one or more VNIsto which the one MAC address is mapped. Therefore, in one embodiment ofthe invention, the MAC-to-VNI table may consolidate information mappingwhich MAC addresses (representative of hosts or virtual machines) areassociated with or known on which VNIs (representative of VL2 broadcastdomains).

In Step 1206, based on the lookup (performed in Step 1204), adetermination is made as to whether the non-intercept destination host(or non-intercept destination virtual machine) MAC address is known onthe original VNI. In one embodiment of the invention, if it isdetermined that an entry in the MAC-to-VNI table maps the non-interceptdestination host (or non-intercept destination virtual machine) MACaddress to at least the original VNI, then the non-intercept destinationhost/virtual machine MAC address is recognized as being known on theoriginal VNI. Accordingly, based on this determination, the process mayproceed to Step 1208. On the other hand, in another embodiment of theinvention, if it is alternatively determined that an entry in theMAC-to-VNI table fails to map the non-intercept destination host (ornon-intercept destination virtual machine) MAC address to at least theoriginal VNI, then the non-intercept destination host/virtual machineMAC address is recognized as being unknown on the original VNI.Accordingly, based on this determination, the process may alternativelyproceed to Step 1210.

In Step 1208, after determining (in Step 1206) that the non-interceptdestination host (or non-intercept destination virtual machine) MACaddress is known on the original VNI, a network interface out of whichthe unicast MAC frame may be transmitted, towards the non-interceptdestination host/virtual machine, is identified. In one embodiment ofthe invention, the aforementioned network interface, entailing either aphysical or virtual network interface, may be identified through theperformance of a lookup on a MAC address table using the non-interceptdestination host (or non-intercept destination virtual machine) MACaddress. The MAC address table may refer to a data structure thatmaintains one or more entries, where each entry not only specifies outwhich network interface to forward network traffic, but also throughwhich overlay tunnel, if any, should the network traffic be transmittedthrough in order to reach their desired destination or a next hop alongthe way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through a certain (non-intercept) networkinterface of the non-service (remote) VTEP. Accordingly, based on thisdetermination, the unicast MAC frame may be bridged across theidentified network interface of the non-service (remote) VTEP to thedirectly-connected non-intercept destination host/virtual machine.

In Step 1210, after determining (in Step 1206) that the non-interceptdestination host (or non-intercept destination virtual machine) MACaddress is unknown on the original VNI, the unicast MAC frame is floodedto all destinations known on the original VNI. In one embodiment of theinvention, a copy of the unicast MAC frame may find its way to thedirectly-connected non-intercept destination host/virtual machine viatraversal of a certain (non-intercept) network interface of thenon-service (remote) VTEP.

FIGS. 13A-13C show flowcharts describing a method for receivinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention. The various steps outlined belowmay be performed by a non-service virtual tunnel end point (VTEP) (i.e.,a VTEP not directly-connected to a service device (or a remote VTEP)).Further, while the various steps in the flowcharts are presented anddescribed sequentially, one of ordinary skill will appreciate that someor all steps may be executed in different orders, may be combined oromitted, and some or all steps may be executed in parallel.

Turning to FIG. 13A, in Step 1300, a virtual layer-3 (VL3) frame isreceived. In one embodiment of the invention, the VL3 frame may haveoriginated from a service VTEP. Further, the VL3 frame may include orspecify a reverse-service virtual network identifier (VNI) within headerinformation. The reverse-service VNI may identify with a reverse-servicevirtual layer-2 (VL2) broadcast domain. Moreover, the reverse VL2broadcast domain may be implemented as a unique, unidirectional overlaytunnel (e.g., a VXLAN tunnel) through which network traffic, addressedto an intercept host/virtual machine, may be directed thereto afterinspection.

In Step 1302, the VL3 frame (received in Step 1300) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a unicast media access control (MAC) framecopy (i.e., mirrored to a loop-start interface (LSI) of the service VTEPand subsequently forwarded toward the non-service (remote) VTEP afterservice device inspection) enclosed therein. The unicast MAC frame copymay have originated from a remote, intercept source host (or interceptsource virtual machine). The unicast MAC frame copy may also beaddressed to an intercept destination host (or intercept virtualmachine). Furthermore, the unicast MAC frame copy may include or specifya reverse-service VL2 broadcast domain tag (e.g., a reverse-servicevirtual local area network (VLAN) tag). The reverse-service VL2broadcast domain tag may include information that identifies the unicastMAC frame copy as being associated with the reverse-service VL2broadcast domain. The reverse-service VL2 broadcast domain tag mayinclude additional information without departing from the scope of theinvention.

In Step 1304, a lookup is performed on the reverse-service VNI using theintercept destination host (or intercept destination virtual machine)MAC address specified in header information of the unicast MAC framecopy. In one embodiment of the invention, the aforementioned lookup mayentail searching through one or more entries in a MAC-to-VNI table foran entry that specifies at least the intercept destination host (orintercept destination virtual machine) MAC address. The aforementionedMAC-to-VNI table may maintain one or more entries, where each entry mayinclude or specify one MAC address and one or more VNIs to which the oneMAC address is mapped. Therefore, in one embodiment of the invention,the MAC-to-VNI table may consolidate information mapping which MACaddresses (representative of hosts or virtual machines) are associatedwith or known on which VNIs (representative of VL2 broadcast domains).

In Step 1306, based on the lookup (performed in Step 1304), adetermination is made as to whether the intercept destination host (orintercept destination virtual machine) MAC address is known on thereverse-service VNI. In one embodiment of the invention, if it isdetermined that an entry in the MAC-to-VNI table maps the interceptdestination host (or intercept destination virtual machine) MAC addressto at least the reverse-service VNI, then the intercept destinationhost/virtual machine MAC address is recognized as being known on thereverse-service VNI. Accordingly, based on this determination, theprocess may proceed to Step 1320 (see e.g., FIG. 13B). On the otherhand, in another embodiment of the invention, if it is alternativelydetermined that an entry in the MAC-to-VNI table fails to map theintercept destination host (or intercept destination virtual machine)MAC address to at least the reverse-service VNI, then the interceptdestination host/virtual machine MAC address is recognized as beingunknown on the reverse-service VNI. Accordingly, based on thisdetermination, the process may alternatively proceed to Step 1340 (seee.g., FIG. 13C).

Turning to FIG. 13B, in Step 1320, after determining (in Step 1306) thatthe destination host (or destination virtual machine) MAC address isknown on the reverse-service VNI, a network interface out of which theunicast MAC frame copy may be transmitted, towards the interceptdestination host/virtual machine, is identified. In one embodiment ofthe invention, the aforementioned network interface, entailing either aphysical or virtual network interface, may be identified through theperformance of a lookup on a MAC address table using the interceptdestination host (or intercept destination virtual machine) MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe copy should be transmitted through an intercept network interface(INI) (see e.g., FIG. 2) of the non-service (remote) VTEP. Accordingly,based on this determination, the unicast MAC frame copy may be directedto the identified INI of the non-service (remote) VTEP.

In Step 1322, the unicast MAC frame copy is translated into the originalVL2 broadcast domain. In one embodiment of the invention, thistranslation may transpire because of an intercept-specific traffic flowrule (TFR) (described above)—e.g., dictating the translation of anyegress network traffic (i.e., the unicast MAC frame copy) traversing anintercept network interface (INI) of an intercept VTEP (i.e., thenon-service (remote) VTEP) from the reverse-service VL2 broadcast domainto the original VL2 broadcast domain. Furthermore, the aforementionedtranslation may entail replacing the reverse-service VL2 broadcastdomain tag, specified in header information of the unicast MAC framecopy, with an original VL2 broadcast domain tag. The original VL2broadcast domain tag may include information that identifies the unicastMAC frame copy as being associated with the original VL2 broadcastdomain. The original VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.Thereafter, in Step 1324, the unicast MAC frame copy is bridged acrossthe identified INI of the non-service (remote) VTEP to thedirectly-connected intercept destination host (or intercept destinationvirtual machine).

Turning to FIG. 13C, in Step 1340, after determining (in Step 1306) thatthe intercept destination host (or intercept destination virtualmachine) MAC address is unknown on the reverse-service VNI, the unicastMAC frame copy is flooded to all destinations known on thereverse-service VNI. In one embodiment of the invention, through MAClearning and/or the receipt of MAC programming instructions (MPIs)(described above), destinations known on the reverse-service VNI mayinclude, but are not limited to: any and all INIs of the non-service(remote) VTEP, behind which at least one intercept host (or interceptvirtual machine) may reside. Accordingly, a copy of the unicast MACframe copy may find its way to the directly-connected interceptdestination host/virtual machine via traversal of the identified INI ofthe non-service (remote) VTEP.

FIGS. 14A-14C show flowcharts describing a method for receivinginspected unicast network traffic within a zone in accordance with oneor more embodiments of the invention. The various steps outlined belowmay be performed by a non-service virtual tunnel end point (VTEP) (i.e.,a VTEP not directly-connected to a service device (or a remote VTEP)).Further, while the various steps in the flowcharts are presented anddescribed sequentially, one of ordinary skill will appreciate that someor all steps may be executed in different orders, may be combined oromitted, and some or all steps may be executed in parallel.

Turning to FIG. 14A, in Step 1400, a virtual layer-3 (VL3) frame isreceived. In one embodiment of the invention, the VL3 frame may haveoriginated from a service VTEP. Further, the VL3 frame may include orspecify a reverse-service virtual network identifier (VNI) within headerinformation. The reverse-service VNI may identify with a reverse-servicevirtual layer-2 (VL2) broadcast domain. Moreover, the reverse VL2broadcast domain may be implemented as a unique, unidirectional overlaytunnel (e.g., a VXLAN tunnel) through which network traffic, addressedto an intercept host/virtual machine, may be directed thereto afterinspection.

In Step 1402, the VL3 frame (received in Step 1400) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a unicast media access control (MAC) frameenclosed therein. The unicast MAC frame may have originated from aremote, non-intercept source host (or non-intercept source virtualmachine). The unicast MAC frame may also be addressed to an interceptdestination host (or intercept virtual machine). Furthermore, theunicast MAC frame may include or specify a reverse-service VL2 broadcastdomain tag (e.g., a reverse-service virtual local area network (VLAN)tag). The reverse-service VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith the reverse-service VL2 broadcast domain. The reverse-service VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In Step 1404, a lookup is performed on the reverse-service VNI using theintercept destination host (or intercept destination virtual machine)MAC address specified in header information of the unicast MAC frame. Inone embodiment of the invention, the aforementioned lookup may entailsearching through one or more entries in a MAC-to-VNI table for an entrythat specifies at least the intercept destination host (or interceptdestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 1406, based on the lookup (performed in Step 1404), adetermination is made as to whether the intercept destination host (orintercept destination virtual machine) MAC address is known on thereverse-service VNI. In one embodiment of the invention, if it isdetermined that an entry in the MAC-to-VNI table maps the interceptdestination host (or intercept destination virtual machine) MAC addressto at least the reverse-service VNI, then the intercept destinationhost/virtual machine MAC address is recognized as being known on thereverse-service VNI. Accordingly, based on this determination, theprocess may proceed to Step 1420 (see e.g., FIG. 14B). On the otherhand, in another embodiment of the invention, if it is alternativelydetermined that an entry in the MAC-to-VNI table fails to map theintercept destination host (or intercept destination virtual machine)MAC address to at least the reverse-service VNI, then the interceptdestination host/virtual machine MAC address is recognized as beingunknown on the reverse-service VNI. Accordingly, based on thisdetermination, the process may alternatively proceed to Step 1440 (seee.g., FIG. 14C).

Turning to FIG. 14B, in Step 1420, after determining (in Step 1406) thatthe destination host (or destination virtual machine) MAC address isknown on the reverse-service VNI, a network interface out of which theunicast MAC frame may be transmitted, towards the intercept destinationhost/virtual machine, is identified. In one embodiment of the invention,the aforementioned network interface, entailing either a physical orvirtual network interface, may be identified through the performance ofa lookup on a MAC address table using the intercept destination host (orintercept destination virtual machine) MAC address. The MAC addresstable may refer to a data structure that maintains one or more entries,where each entry not only specifies out which network interface toforward network traffic, but also through which overlay tunnel, if any,should the network traffic be transmitted through in order to reachtheir desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through an intercept network interface (INI)(see e.g., FIG. 2) of the non-service (remote) VTEP. Accordingly, basedon this determination, the unicast MAC frame may be directed to theidentified INI of the non-service (remote) VTEP.

In Step 1422, the unicast MAC frame is translated into the original VL2broadcast domain. In one embodiment of the invention, this translationmay transpire because of an intercept-specific traffic flow rule (TFR)(described above)—e.g., dictating the translation of any egress networktraffic (i.e., the unicast MAC frame) traversing an intercept networkinterface (INI) of an intercept VTEP (i.e., the non-service (remote)VTEP) from the reverse-service VL2 broadcast domain to the original VL2broadcast domain. Furthermore, the aforementioned translation may entailreplacing the reverse-service VL2 broadcast domain tag, specified inheader information of the unicast MAC frame, with an original VL2broadcast domain tag. The original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith the original VL2 broadcast domain. The original VL2 broadcastdomain tag may include additional information without departing from thescope of the invention. Thereafter, in Step 1424, the unicast MAC frameis bridged across the identified INI of the non-service (remote) VTEP tothe directly-connected intercept destination host (or interceptdestination virtual machine).

Turning to FIG. 14C, in Step 1440, after determining (in Step 1406) thatthe intercept destination host (or intercept destination virtualmachine) MAC address is unknown on the reverse-service VNI, the unicastMAC frame is flooded to all destinations known on the reverse-serviceVNI. In one embodiment of the invention, through MAC learning and/or thereceipt of MAC programming instructions (MPIs) (described above),destinations known on the reverse-service VNI may include, but are notlimited to: any and all INIs of the non-service (remote) VTEP, behindwhich at least one intercept host (or intercept virtual machine) mayreside. Accordingly, a copy of the unicast MAC frame may find its way tothe directly-connected intercept destination host/virtual machine viatraversal of the identified INI of the non-service (remote) VTEP.

FIGS. 15A-15C show flowcharts describing a method for transmittingredirected broadcast network traffic within a zone in accordance withone or more embodiments of the invention. The various steps outlinedbelow may be performed by a non-service virtual tunnel end point (VTEP)(i.e., a VTEP not directly-connected to a service device (or a remoteVTEP)). Further, while the various steps in the flowcharts are presentedand described sequentially, one of ordinary skill will appreciate thatsome or all steps may be executed in different orders, may be combinedor omitted, and some or all steps may be executed in parallel.

Turning to FIG. 15A, in Step 1500, a broadcast media access control(MAC) frame is received. In one embodiment of the invention, a broadcastMAC frame may refer to a MAC frame addressed to multiple—e.g., any andall—destination hosts (or destination virtual machines). Further, thebroadcast MAC frame may have been generated and transmitted by, andthus, may have originated from a directly-connected source host (orsource virtual machine). Moreover, in one embodiment of the invention,the broadcast MAC frame may include or specify an original virtuallayer-2 (VL2) broadcast domain tag (e.g., an original virtual local areanetwork (VLAN) tag). The original VL2 broadcast domain tag may includeinformation that identifies the broadcast MAC frame as being associatedwith an original VL2 broadcast domain (e.g., an original VLAN). Theoriginal VL2 broadcast domain tag may include additional informationwithout departing from the scope of the invention.

In another embodiment of the invention, in Step 1502, a broadcast MACframe lacking a VL2 broadcast domain tag may be received. Accordingly,the broadcast MAC frame may be received untagged. In such an embodiment,based on identifying that the broadcast MAC frame is untagged, in Step1504, a network interface configuration (NIC) for the network interface,through which the untagged broadcast MAC frame had been received, isaccessed. In one embodiment of the invention, the NIC for the networkinterface may track various properties (or attributes) associated withthe network interface. By way an example, the NIC for the networkinterface may track a membership property (or attribute) belonging tothe network interface, which may identify one or more virtual networkidentifiers (VNIs), including a default VNI, of which the networkinterface may be enrolled as a member.

In Step 1506, from the NIC (accessed in Step 1504), the default VNI ofwhich the network interface (i.e., through which the untagged broadcastMAC frame had been received) is a member is identified. Specifically, asmentioned above, the default VNI may be identified by examining amembership property (or attribute) disclosed in the NIC of the networkinterface. Further, the default VNI may subsequently identify thecorresponding default VL2 broadcast domain with which the default VNI isassociated. Accordingly, in one embodiment of the invention, theidentified default VNI for the network interface may identify theoriginal VL2 broadcast domain as the default VL2 broadcast domainassociated with the default VNI. In one or more other embodiments of theinvention, the identified default VNI for the network interface mayalternatively identify any other VL2 broadcast domain as the default VL2broadcast domain associated with the default VNI. Hereinafter, theheader field of the broadcast MAC frame associated with the VL2broadcast domain tag may subsequently be modified to include the defaultVL2 broadcast domain tag (e.g., the original VL2 broadcast domain tag).

In Step 1508, after receipt of the broadcast MAC frame (either in Step1500 or through Steps 1502 to 1506), a determination is made as towhether the source host is an intercept host. In one embodiment of theinvention, an intercept host may refer to a host where network traffictherefrom and/or thereto may be intercepted and inspected by a servicedevice. Identification of the source host as an intercept host may bedetermined based on one or more service policies (specified in redirectcriteria (described above)) and header information specified in thebroadcast MAC frame. For example, the source host may be recognized asan intercept host because the source host MAC address (specified in theheader information of the broadcast MAC frame) is tied to a servicepolicy or rule specified in the redirect criteria. By way of anotherexample, the source host may be recognized as an intercept host becausethe source host IP address (specified in header information of thebroadcast MAC frame) is tied to a service policy or rule specified inthe redirect criteria.

In one embodiment of the invention, if it is determined that the sourcehost (or source virtual machine) is tied to any service policy or rulespecified in the redirect criteria, then the source host (or sourcevirtual machine) is recognized as an intercept host. Accordingly, basedon this determination, the process may proceed to Step 1520 (see e.g.,FIG. 15B). On the other hand, in another embodiment of the invention, ifit is alternatively determined that the source host (or source virtualmachine) is not tied to any service policy or rule specified in theredirect criteria, then the source host (or source virtual machine) isrecognized as a non-intercept host (or virtual machine). Accordingly,based on this determination, the process may alternatively proceed toStep 1540 (see e.g., FIG. 15C).

Turning to FIG. 15B, in Step 1520, after determining (in Step 1508) thatthe source host (or source virtual machine) is an intercept host (orvirtual machine), the broadcast MAC frame (received in Step 1500 or1502) is translated into the forward-service VL2 broadcast domain. Inone embodiment of the invention, this translation may transpire becauseof an intercept-specific traffic flow rule (TFR) (described above)—e.g.,dictating the translation of any ingress network traffic (i.e., thebroadcast MAC frame) traversing an intercept network interface (INI)(see e.g., FIG. 2) of an intercept VTEP from the original VL2 broadcastdomain to the forward-service VL2 broadcast domain, where the source MACaddress specified in the ingress network traffic is associated with anintercept host. Furthermore, the aforementioned translation may entailreplacing the original VL2 broadcast domain tag, specified in headerinformation of the broadcast MAC frame, with a forward-service VL2broadcast domain tag. The forward-service VL2 broadcast domain tag mayinclude information that identifies the unicast MAC frame as beingassociated with a forward-service VL2 broadcast domain. Theforward-service VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.

In Step 1522, the broadcast MAC frame is subsequently flooded to alldestinations known on the forward-service VNI. In one embodiment of theinvention, through MAC learning and/or the receipt of MAC programminginstructions (MPIs) (described above), destinations known on theforward-service VNI may include, but are not limited to: (i) the nearnetwork interface (NNI) of a service VTEP, behind which a service devicemay reside; and (ii) at least one intercept network interface (INI) (seee.g., FIG. 2) of one or more intercept VTEPs, behind which at least oneintercept host (or intercept virtual machine) may reside.

Turning to FIG. 15C, after determining (in Step 1508) that the sourcehost (or source virtual machine) is a non-intercept host (or virtualmachine), the broadcast MAC frame (received in Step 1500 or 1502), thebroadcast MAC frame is flooded to all destinations known on the originalVNI. In one embodiment of the invention, through MAC learning and/or thereceipt of MAC programming instructions (MPIs) (described above),destinations known on the original VNI may include, but are not limitedto: the far network interface (FNI) of a service VTEP, behind which aservice device may reside.

FIGS. 16A-16D show flowcharts describing a method for receivingredirected broadcast network traffic within a zone in accordance withone or more embodiments of the invention. The various steps outlinedbelow may be performed by a service virtual tunnel end point (VTEP)(i.e., a VTEP directly-connected to a service device). Further, whilethe various steps in the flowcharts are presented and describedsequentially, one of ordinary skill will appreciate that some or allsteps may be executed in different orders, may be combined or omitted,and some or all steps may be executed in parallel.

Turning to FIG. 16A, in Step 1600, a virtual layer-3 (VL3) frame isreceived. In one embodiment of the invention, the VL3 frame may haveoriginated from a remote, non-service VTEP. Further, the VL3 frame mayinclude or specify a forward-service virtual network identifier (VNI)within header information. The forward-service VNI may identify with aforward-service virtual layer-2 (VL2) broadcast domain. Moreover, theforward-service VL2 broadcast domain may be implemented as a unique,unidirectional overlay tunnel (e.g., a virtual extensible local areanetwork (VXLAN) tunnel) through which network traffic, intercepted basedon redirect criteria, may have been redirected to a service device forinspection.

In Step 1602, the VL3 frame (received in Step 1600) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a broadcast media access control (MAC) frameenclosed therein. The broadcast MAC frame may have originated from aremote, intercept host (or intercept virtual machine). Furthermore, thebroadcast MAC frame may include or specify a forward-service VL2broadcast domain tag (e.g., a forward-service virtual local area network(VLAN) tag). The forward-service VL2 broadcast domain tag may includeinformation that identifies the broadcast MAC frame as being associatedwith a forward-service VL2 broadcast domain. The forward-service VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In Step 1604, a lookup is performed on a forward-service virtual networkidentifier (VNI) using a destination host (or destination virtualmachine) MAC address specified in header information of the broadcastMAC frame. In one embodiment of the invention, the forward-service VNImay identify with the forward-service VL2 broadcast domain. Moreover,the aforementioned lookup may entail searching through one or moreentries in a MAC-to-VNI table for an entry that specifies at least thedestination host (or destination virtual machine) MAC address. Theaforementioned MAC-to-VNI table may maintain one or more entries, whereeach entry may include or specify one MAC address and one or more VNIsto which the one MAC address is mapped. Therefore, in one embodiment ofthe invention, the MAC-to-VNI table may consolidate information mappingwhich MAC addresses (representative of hosts or virtual machines) areassociated with or known on which VNIs (representative of VL2 broadcastdomains).

In Step 1606, based on the lookup (performed in Step 1604), it isdetermined that the destination host (or destination virtual machine)MAC address is unknown on the forward-service VNI. That is, in oneembodiment of the invention, the destination host (or destinationvirtual machine) MAC address specific to any given broadcast MAC frame(e.g., the broadcast MAC frame obtained in Step 1602) is a uniquebroadcast MAC address—i.e., FF:FF:FF:FF:FF:FF. Further, this uniquebroadcast MAC address may be configured such that it is never known toat least the forward-service VNI. Subsequently, the destinationhost/virtual machine MAC address is recognized as being unknown on theforward-service VNI. Accordingly, based on this determination, theprocess proceeds to Step 1640 (see e.g., FIG. 16C).

Turning to FIG. 16B, rather than receiving a VL3 frame (in Step 1600),in another embodiment of the invention and in Step 1620, a broadcast MACframe is received. In one embodiment of the invention, the broadcast MACframe may have been generated and transmitted by, and thus, may haveoriginated from a directly-connected source host (or source virtualmachine). Moreover, in one embodiment of the invention, the broadcastMAC frame may include or specify an original virtual layer-2 (VL2)broadcast domain tag (e.g., an original virtual local area network(VLAN) tag). The original VL2 broadcast domain tag may includeinformation that identifies the broadcast MAC frame as being associatedwith an original VL2 broadcast domain (e.g., an original VLAN). Theoriginal VL2 broadcast domain tag may include additional informationwithout departing from the scope of the invention.

Further, in another embodiment of the invention, in Step 1622, abroadcast MAC frame lacking a VL2 broadcast domain tag may be received.Accordingly, the broadcast MAC frame may be received untagged. In suchan embodiment, based on identifying that the broadcast MAC frame isuntagged, in Step 1624, a network interface configuration (NIC) for thenetwork interface, through which the untagged broadcast MAC frame hadbeen received, is accessed. In one embodiment of the invention, the NICfor the network interface may track various properties (or attributes)associated with the network interface. By way an example, the NIC forthe network interface may track a membership property (or attribute)belonging to the network interface, which may identify one or morevirtual network identifiers (VNIs), including a default VNI, of whichthe network interface may be enrolled as a member.

In Step 1626, from the NIC (accessed in Step 1624), the default VNI ofwhich the network interface (i.e., through which the untagged broadcastMAC frame had been received) is a member is identified. Specifically, asmentioned above, the default VNI may be identified by examining amembership property (or attribute) disclosed in the NIC of the networkinterface. Further, the default VNI may subsequently identify thecorresponding default VL2 broadcast domain with which the default VNI isassociated. Accordingly, in one embodiment of the invention, theidentified default VNI for the network interface may identify theoriginal VL2 broadcast domain as the default VL2 broadcast domainassociated with the default VNI. In one or more other embodiments of theinvention, the identified default VNI for the network interface mayalternatively identify any other VL2 broadcast domain as the default VL2broadcast domain associated with the default VNI. Hereinafter, theheader field of the broadcast MAC frame associated with the VL2broadcast domain tag may subsequently be modified to include the defaultVL2 broadcast domain tag (e.g., the original VL2 broadcast domain tag).

In Step 1628, after receipt of the broadcast MAC frame (either in Step1620 or through Steps 1622 to 1626), a determination is made as towhether the source host is an intercept host. In one embodiment of theinvention, an intercept host may refer to a host where network traffictherefrom and/or thereto may be intercepted and inspected by a servicedevice. Identification of the source host as an intercept host may bedetermined based on one or more service policies (specified in redirectcriteria (described above)) and header information specified in thebroadcast MAC frame. For example, the source host may be recognized asan intercept host because the source host MAC address (specified in theheader information of the broadcast MAC frame) is tied to a servicepolicy or rule specified in the redirect criteria. By way of anotherexample, the source host may be recognized as an intercept host becausethe source host IP address (specified in header information of thebroadcast MAC frame) is tied to a service policy or rule specified inthe redirect criteria.

In one embodiment of the invention, if it is determined that the sourcehost (or source virtual machine) is tied to any service policy or rulespecified in the redirect criteria, then the source host (or sourcevirtual machine) is recognized as an intercept host. Accordingly, basedon this determination, the process may proceed to Step 1630. On theother hand, in another embodiment of the invention, if it isalternatively determined that the source host (or source virtualmachine) is not tied to any service policy or rule specified in theredirect criteria, then the source host (or source virtual machine) isrecognized as a non-intercept host (or virtual machine). Accordingly,based on this determination, the process may alternatively proceed toStep 1660 (see e.g., FIG. 16D).

In Step 1630, after determining (in Step 1628) that the source host (orsource virtual machine) is an intercept host/virtual machine, thebroadcast MAC frame (received in Step 1620 or 1622) is translated intothe forward-service VL2 broadcast domain. In one embodiment of theinvention, this translation may transpire because of anintercept-specific traffic flow rule (TFR) (described above)—e.g.,dictating the translation of any ingress network traffic (i.e., thebroadcast MAC frame) traversing an intercept network interface (INI)(see e.g., FIG. 2) of an intercept VTEP from the original VL2 broadcastdomain to the forward-service VL2 broadcast domain, where the source MACaddress specified in the ingress network traffic is associated with anintercept host. Furthermore, the aforementioned translation may entailreplacing the original VL2 broadcast domain tag, specified in headerinformation of the broadcast MAC frame, with a forward-service VL2broadcast domain tag. The forward-service VL2 broadcast domain tag mayinclude information that identifies the unicast MAC frame as beingassociated with a forward-service VL2 broadcast domain. Theforward-service VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.Hereinafter, the process may proceed to Step 1604 (see e.g., FIG. 16A).

Turning to FIG. 16C, in Step 1640, based on the determination (in Step1606) that the destination host (or destination virtual machine) MACaddress is unknown on the forward-service VNI, a network interface outof which the broadcast MAC frame may be transmitted, towards the servicedevice, is identified. In one embodiment of the invention, theaforementioned network interface, entailing either a physical or virtualnetwork interface, may be identified through the performance of a lookupon a MAC address table using the destination host (or destinationvirtual machine) MAC address. The MAC address table may refer to a datastructure that maintains one or more entries, where each entry not onlyspecifies out which network interface to forward network traffic, butalso through which overlay tunnel, if any, should the network traffic betransmitted through in order to reach their desired destination or anext hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the broadcast MACframe should be transmitted through the near network interface (NNI) ofthe service VTEP. Accordingly, based on this determination, the unicastMAC frame may be directed to the NNI of the service VTEP.

In Step 1642, the broadcast MAC frame is subsequently translated intothe original VL2 broadcast domain. In one embodiment of the invention,this translation may transpire because of a service-specific trafficflow rule (TFR) (described above)—e.g., dictating the translation of anyegress network traffic (i.e., the broadcast MAC frame) traversing theNNI of the service VTEP from the forward-service VL2 broadcast domain tothe original VL2 broadcast domain. Furthermore, the aforementionedtranslation may entail replacing the forward-service VL2 broadcastdomain tag, specified in header information of the broadcast MAC frame,with an original VL2 broadcast domain tag. The original VL2 broadcastdomain tag may include information that identifies the broadcast MACframe as being associated with the original VL2 broadcast domain. Theoriginal VL2 broadcast domain tag may include additional informationwithout departing from the scope of the invention. In Step 1644, afterthe translation (performed in Step 1642), the broadcast MAC frame isbridged across the NNI of the service VTEP to a directly-connectedservice device.

Turning to FIG. 16D, in Step 1660, after determining (in Step 1628) thatthe source host (or source virtual machine) is a non-intercepthost/virtual machine, a network interface out of which the broadcast MACframe may be transmitted, towards the service device, is identified. Inone embodiment of the invention, the aforementioned network interface,entailing either a physical or virtual network interface, may beidentified through the performance of a lookup on a MAC address tableusing the destination host (or destination virtual machine) MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the broadcast MACframe should be transmitted through the far network interface (FNI) ofthe service VTEP. Accordingly, based on this determination, thebroadcast MAC frame may be directed to the FNI of the service VTEP.Thereafter, in Step 1662, the broadcast MAC frame is subsequentlybridged across the FNI of the service VTEP to a directly-connectedservice device.

FIGS. 17A and 17B show flowcharts describing a method for transmittinginspected broadcast network traffic within a zone in accordance with oneor more embodiments of the invention. The various steps outlined belowmay be performed by a service virtual tunnel end point (VTEP) (i.e., aVTEP directly-connected to a service device). Further, while the varioussteps in the flowcharts are presented and described sequentially, one ofordinary skill will appreciate that some or all steps may be executed indifferent orders, may be combined or omitted, and some or all steps maybe executed in parallel.

Turning to FIG. 17A, a broadcast media access control (MAC) frame isreceived from a directly-connected service device. In one embodiment ofthe invention, the broadcast MAC frame may arrive through a far networkinterface (FNI) (see e.g., FIG. 2) of the service VTEP. Further, thebroadcast MAC frame may include or specify an original virtual layer-2(VL2) broadcast domain tag within its L2 header information. Theoriginal VL2 broadcast domain tag may include information thatidentifies the broadcast MAC frame as being associated with an originalVL2 broadcast domain. The original VL2 broadcast domain tag may includeadditional information without departing from the scope of theinvention.

In Step 1702, a broadcast MAC frame copy is obtained through portmirroring. In one embodiment of the invention, port mirroring may referto the replication of network traffic seen on one network interface toyield a copy of that network traffic, which may then be directed toanother network interface. Furthermore, the port mirroring may transpirebecause of a service-specific network interface configuration (NIC)(described above)—e.g., dictating the configuration of a mirroringproperty (or attribute) belonging to the FNI of the service VTEP suchthat the FNI mirrors any ingress network traffic at the FNI to theloop-start interface (LSI) (see e.g., FIG. 2) of the service VTEP.Accordingly, in Step 1704, based on the aforementioned service-specificNIC, the broadcast MAC frame copy (obtained in Step 1702) is directed tothe LSI of the service VTEP.

In Step 1706, the broadcast MAC frame (received in Step 1700) issubsequently flooded to all destinations known on an original virtualnetwork identifier (VNI). In one embodiment of the invention, theoriginal VNI may identify with the original VL2 broadcast domain.Further, through MAC learning and/or the receipt of MAC programminginstructions (MPIs) (described above), destinations known on theoriginal VNI may include, but are not limited to: any and allnon-intercept hosts (or non-intercept virtual machines). Accordingly, acopy of the broadcast MAC frame may find its way to all non-interceptdestination hosts (or non-intercept destination virtual machines), whichmay lie behind one or more remote VTEPs or may be directly-connected tothe service VTEP.

Turning to FIG. 17B, after the broadcast MAC frame copy (obtained inStep 1702) is directed to the LSI of the service VTEP (in Step 1704),the broadcast MAC frame copy is received at a loop-end interface (LEI)(see e.g., FIG. 2) of the service VTEP. In one embodiment of theinvention, the LSI and the LEI may be connected together using aphysical loopback cable. Accordingly, any egress network traffictraversing the LSI becomes ingress network traffic arriving at the LEI.

In Step 1722, the unicast MAC frame copy is translated into thereverse-service VL2 broadcast domain. In one embodiment of theinvention, this translation may transpire because of a service-specifictraffic flow rule (TFR) (described above)—e.g., dictating thetranslation of any ingress network traffic (i.e., the broadcast MACframe copy) traversing the LEI of the service VTEP from the original VL2broadcast domain to the reverse-service VL2 broadcast domain.Furthermore, the aforementioned translation may entail replacing theoriginal VL2 broadcast domain tag, specified in header information ofthe broadcast MAC frame copy, with a reverse-service VL2 broadcastdomain tag. The reverse-service VL2 broadcast domain tag may includeinformation that identifies the broadcast MAC frame copy as beingassociated with a reverse-service VL2 broadcast domain. Thereverse-service VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.

In Step 1724, the broadcast MAC frame copy (received in Step 1720) issubsequently flooded to all destinations known on a reverse-service VNI.In one embodiment of the invention, the reverse-service VNI may identifywith the reverse-service VL2 broadcast domain. Further, through MAClearning and/or the receipt of MAC programming instructions (MPIs)(described above), destinations known on the reverse-service VNI mayinclude, but are not limited to: any and all intercept hosts (orintercept virtual machines). Accordingly, a copy of the broadcast MACframe copy may find its way to all intercept destination hosts (orintercept destination virtual machines), which may lie behind one ormore remote VTEPs or may be directly-connected to the service VTEP.

FIG. 18 shows a flowchart describing a method for transmitting inspectedbroadcast network traffic within a zone in accordance with one or moreembodiments of the invention. The various steps outlined below may beperformed by a service virtual tunnel end point (VTEP) (i.e., a VTEPdirectly-connected to a service device). Further, while the varioussteps in the flowcharts are presented and described sequentially, one ofordinary skill will appreciate that some or all steps may be executed indifferent orders, may be combined or omitted, and some or all steps maybe executed in parallel.

Turning to FIG. 18, in Step 1800, a broadcast media access control (MAC)frame is received from a directly-connected service device. In oneembodiment of the invention, the broadcast MAC frame may arrive througha near network interface (NNI) (see e.g., FIG. 2) of the service VTEP.Further, the broadcast MAC frame may include or specify an originalvirtual layer-2 (VL2) broadcast domain tag within its L2 headerinformation. The original VL2 broadcast domain tag may includeinformation that identifies the broadcast MAC frame as being associatedwith an original VL2 broadcast domain. The original VL2 broadcast domaintag may include additional information without departing from the scopeof the invention.

In Step 1802, the broadcast MAC frame is translated into thereverse-service VL2 broadcast domain. In one embodiment of theinvention, this translation may transpire because of a service-specifictraffic flow rule (TFR) (described above)—e.g., dictating thetranslation of any egress network traffic (i.e., the broadcast MACframe) traversing the NNI of the service VTEP from the original VL2broadcast domain to the reverse-service VL2 broadcast domain.Furthermore, the aforementioned translation may entail replacing theoriginal VL2 broadcast domain tag, specified in header information ofthe broadcast MAC frame, with a reverse-service VL2 broadcast domaintag. The reverse-service VL2 broadcast domain tag may includeinformation that identifies the broadcast MAC frame as being associatedwith the reverse-service VL2 broadcast domain. The reverse-service VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In Step 1804, the broadcast MAC frame (received in Step 1800) issubsequently flooded to all destinations known on a reverse-service VNI.In one embodiment of the invention, the reverse-service VNI may identifywith the reverse-service VL2 broadcast domain. Further, through MAClearning and/or the receipt of MAC programming instructions (MPIs)(described above), destinations known on the reverse-service VNI mayinclude, but are not limited to: any and all intercept hosts (orintercept virtual machines). Accordingly, a copy of the broadcast MACframe may find its way to all intercept destination hosts (or interceptdestination virtual machines), which may lie behind one or more remoteVTEPs or may be directly-connected to the service VTEP.

FIGS. 19A and 19B show flowcharts describing a method for transmittingredirected unicast network traffic within a first zone in accordancewith one or more embodiments of the invention. The various stepsoutlined below may be performed by a first non-service virtual tunnelend point (VTEP) (i.e., a VTEP not directly-connected to a servicedevice (or a remote VTEP)) residing within a first subnet or zone.Further, while the various steps in the flowcharts are presented anddescribed sequentially, one of ordinary skill will appreciate that someor all steps may be executed in different orders, may be combined oromitted, and some or all steps may be executed in parallel.

Turning to FIG. 19A, in Step 1900, a unicast media access control (MAC)frame is received. In one embodiment of the invention, a unicast MACframe may refer to a MAC frame addressed to a single destination host(or destination virtual machine). Further, the unicast MAC frame mayhave been generated and transmitted by, and thus, may have originatedfrom a directly-connected source host (or source virtual machine).Moreover, in one embodiment of the invention, the unicast MAC frame mayinclude or specify an original virtual layer-2 (VL2) broadcast domaintag (e.g., an original virtual local area network (VLAN) tag). Theoriginal VL2 broadcast domain tag may include information thatidentifies the unicast MAC frame as being associated with an originalVL2 broadcast domain (e.g., an original VLAN). The original VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In another embodiment of the invention, in Step 1902, a unicast MACframe lacking a VL2 broadcast domain tag may be received. Accordingly,the unicast MAC frame may be received untagged. In such an embodiment,based on identifying that the unicast MAC frame is untagged, in Step1904, a network interface configuration (NIC) for the network interface,through which the untagged unicast MAC frame had been received, isaccessed. In one embodiment of the invention, the NIC for the networkinterface may track various properties (or attributes) associated withthe network interface. By way an example, the NIC for the networkinterface may track a membership property (or attribute) belonging tothe network interface, which may identify one or more virtual networkidentifiers (VNIs), including a default VNI, of which the networkinterface may be enrolled as a member.

In Step 1906, from the NIC (accessed in Step 1904), the default VNI ofwhich the network interface (i.e., through which the untagged unicastMAC frame had been received) is a member is identified. Specifically, asmentioned above, the default VNI may be identified by examining amembership property (or attribute) disclosed in the NIC of the networkinterface. Further, the default VNI may subsequently identify thecorresponding default VL2 broadcast domain with which the default VNI isassociated. Accordingly, in one embodiment of the invention, theidentified default VNI for the network interface may identify theoriginal VL2 broadcast domain as the default VL2 broadcast domainassociated with the default VNI. In one or more other embodiments of theinvention, the identified default VNI for the network interface mayalternatively identify any other VL2 broadcast domain as the default VL2broadcast domain associated with the default VNI. Hereinafter, theheader field of the unicast MAC frame associated with the VL2 broadcastdomain tag may subsequently be modified to include the default VL2broadcast domain tag (e.g., the original VL2 broadcast domain tag).

In Step 1908, after receipt of the unicast MAC frame (either in Step1900 or through Steps 1902 to 1906), the destination host MAC address isidentified as a virtual address resolution protocol (VARP) MAC address.In one embodiment of the invention, the VARP may be directed tooptimizing L3 forwarding across a network. Specifically, the VARP may beimplemented by configuring multiple network elements with a sharedvirtual IP address (i.e., a VARP IP address) that may resolve to ashared virtual MAC address (i.e., the VARP MAC address). Further, when ahost transmits a MAC frame specifying the shared virtual MAC address,any one of the multiple network elements may intercept the MAC frameand, subsequently, may perform L3 routing.

Accordingly, in Step 1910, a lookup is performed on a MAC address tableusing the VARP MAC address. The MAC address table may refer to a datastructure that maintains one or more entries, where each entry not onlyspecifies out which network interface to forward network traffic, butalso through which overlay tunnel, if any, should the network traffic betransmitted through in order to reach their desired destination or anext hop along the way.

Turning to FIG. 19B, in Step 1920, based on the above-mentioned lookupon the MAC address table (performed in Step 1910), it may be determinedthat that the unicast MAC frame should be transmitted to a first serviceVTEP (i.e., the service VTEP servicing the local subnet or zone).Accordingly, based on this determination, the unicast MAC frame may betranslated into the forward-service VL2 broadcast domain. In oneembodiment of the invention, the aforementioned translation may entailreplacing the first original VL2 broadcast domain tag, specified inheader information of the unicast MAC frame, with a forward-service VL2broadcast domain tag. The forward-service VL2 broadcast domain tag mayinclude information that identifies the unicast MAC frame as beingassociated with a forward-service VL2 broadcast domain. Theforward-service VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.

In Step 1922, a lookup is performed on a forward-service virtual networkidentifier (VNI) using the VARP MAC address specified in headerinformation of the unicast MAC frame. In one embodiment of theinvention, the forward-service VNI may identify with the forward-serviceVL2 broadcast domain. Moreover, the aforementioned lookup may entailsearching through one or more entries in a MAC-to-VNI table for an entrythat specifies at least the destination host (or destination virtualmachine) MAC address. The aforementioned MAC-to-VNI table may maintainone or more entries, where each entry may include or specify one MACaddress and one or more VNIs to which the one MAC address is mapped.Therefore, in one embodiment of the invention, the MAC-to-VNI table mayconsolidate information mapping which MAC addresses (representative ofhosts or virtual machines) are associated with or known on which VNIs(representative of VL2 broadcast domains).

In Step 1924, based on the lookup (performed in Step 1922), adetermination is made as to whether the VARP MAC address is known on theforward-service VNI. In one embodiment of the invention, if it isdetermined that an entry in the MAC-to-VNI table maps VARP MAC addressto at least the forward-service VNI, then the VARP MAC address isrecognized as being known on the forward-service VNI. Accordingly, basedon this determination, the process may proceed to Step 1926. On theother hand, in another embodiment of the invention, if it isalternatively determined that an entry in the MAC-to-VNI table fails tomap the VARP MAC address to at least the forward-service VNI, then theVARP MAC address is recognized as being unknown on the forward-serviceVNI. Accordingly, based on this determination, the process mayalternatively proceed to Step 1930.

In Step 1926, after determining (in Step 1924) that the VARP MAC addressis known on the forward-service VNI, a network interface out of whichthe unicast MAC frame may be transmitted, towards the first serviceVTEP, is identified. In one embodiment of the invention, theaforementioned network interface, entailing either a physical or virtualnetwork interface, may be identified through the performance of a lookupon a MAC address table using the VARP MAC address.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through a certain network interface, whichleads to the first service VTEP, and using an overlay tunnel thatimplements the forward-service VL2 broadcast domain. Subsequently, theunicast MAC frame may be encapsulated in a virtual layer-3 (VL3) framesuch as, for example, a VXLAN frame, where the VL3 frame may includeheader information that specifies, at least in part, the forward-serviceVNI.

In Step 1928, the VL3 frame (obtained in Step 1926) is transmitted,through an L3 fabric (see e.g., FIG. 1), towards the first service VTEP.Specifically, in one embodiment of the invention, the VL3 frame maytraverse through an overlay tunnel—i.e., representative of theforward-service VL2 broadcast domain—that originates at the firstnon-service VTEP (which had obtained the unicast MAC frame in Step 1900or 1902) and, subsequently, terminates at the first service VTEP, behindwhich a first service device (i.e., the service device servicing thelocal subnet or zone) resides.

In Step 1930, after determining (in Step 1924) that the VARP MAC addressis unknown on the forward-service VNI, the unicast MAC frame is floodedto all destinations known on the forward-service VNI. In one embodimentof the invention, through MAC learning and/or the receipt of MACprogramming instructions (MPIs) (described above), destinations known onthe forward-service VNI may include, but are not limited to: (i) thenear network interface (NNI) of the first service VTEP, behind which thefirst service device may reside; and (ii) at least one intercept networkinterface (INI) (see e.g., FIG. 2) of one or more intercept VTEPs,behind which at least one intercept host (or intercept virtual machine)may reside. Furthermore, based on the imposition of intercept-specifictraffic flow rules (TFRs), copies of the unicast MAC frame, intended tobe flooded to the at least one INI of one or more intercept VTEPs, maybe dropped in order to reduce duplicate network traffic delivery.Accordingly, only the copy of the unicast MAC frame, intended to beflooded to the NNI of the first service VTEP, may find its way thereto.

FIGS. 20A and 20B show flowcharts describing a method for receivingredirected unicast network traffic within a first zone in accordancewith one or more embodiments of the invention. The various stepsoutlined below may be performed by a first service virtual tunnel endpoint (VTEP) (i.e., a VTEP directly-connected to a first service device)residing within a first subnet or zone. Further, while the various stepsin the flowcharts are presented and described sequentially, one ofordinary skill will appreciate that some or all steps may be executed indifferent orders, may be combined or omitted, and some or all steps maybe executed in parallel.

Turning to FIG. 20A, in Step 2000 and in one embodiment of theinvention, a virtual layer-3 (VL3) frame is received. In one embodimentof the invention, the VL3 frame may have originated from a first remote,non-service VTEP (residing within a first subnet or zone). Further, theVL3 frame may include or specify a forward-service virtual networkidentifier (VNI) within header information. The forward-service VNI mayidentify with a forward-service virtual layer-2 (VL2) broadcast domain.

In Step 2002, the VL3 frame (received in Step 2000) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a unicast media access control (MAC) frameenclosed therein. The unicast MAC frame may have originated from a firstremote, intercept host (or intercept virtual machine). Furthermore, theunicast MAC frame may include or specify a forward-service VL2 broadcastdomain tag (e.g., a forward-service virtual local area network (VLAN)tag). The forward-service VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith a forward-service VL2 broadcast domain. The forward-service VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In Step 2004 and in another embodiment of the invention, rather than aVL3 frame (as was the case in Step 2000), a unicast MAC frame isreceived. In one embodiment of the invention, the unicast MAC frame mayhave been generated and transmitted by, and thus, may have originatedfrom a directly-connected source host (or source virtual machine).Moreover, the unicast MAC frame may include or specify a first originalVL2 broadcast domain tag (e.g., an original virtual local area network(VLAN) tag). The original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith the first original VL2 broadcast domain (e.g., an original VLAN).The first original VL2 broadcast domain tag may include additionalinformation without departing from the scope of the invention.

In Step 2006, the destination host MAC address, specified in headerinformation of the unicast MAC frame (received in Step 2004) isidentified as a virtual address resolution protocol (VARP) MAC address.In one embodiment of the invention, the VARP may be directed tooptimizing L3 forwarding across a network. Specifically, the VARP may beimplemented by configuring multiple network elements with a sharedvirtual IP address (i.e., a VARP IP address) that may resolve to ashared virtual MAC address (i.e., the VARP MAC address). Further, when ahost transmits a MAC frame specifying the shared virtual MAC address,any one of the multiple network elements may intercept the MAC frameand, subsequently, may perform L3 routing. Accordingly, hereinafter, alookup is performed on a MAC address table using the VARP MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In Step 2008, based on the above-mentioned lookup on the MAC addresstable, it may be determined that that the unicast MAC frame should betransmitted to a first service VTEP (i.e., the service VTEP servicingthe local subnet or zone). Accordingly, based on this determination, theunicast MAC frame may be translated into the forward-service VL2broadcast domain. In one embodiment of the invention, the aforementionedtranslation may entail replacing the first original VL2 broadcast domaintag, specified in header information of the unicast MAC frame, with aforward-service VL2 broadcast domain tag. The forward-service VL2broadcast domain tag may include information that identifies the unicastMAC frame as being associated with a forward-service VL2 broadcastdomain. The forward-service VL2 broadcast domain tag may includeadditional information without departing from the scope of theinvention.

In Step 2010, a lookup is performed on a forward-service virtual networkidentifier (VNI) using VARP MAC address specified in header informationof the unicast MAC frame. In one embodiment of the invention, theforward-service VNI may identify with the forward-service VL2 broadcastdomain. Moreover, the aforementioned lookup may entail searching throughone or more entries in a MAC-to-VNI table for an entry that specifies atleast the destination host (or destination virtual machine) MAC address.The aforementioned MAC-to-VNI table may maintain one or more entries,where each entry may include or specify one MAC address and one or moreVNIs to which the one MAC address is mapped. Therefore, in oneembodiment of the invention, the MAC-to-VNI table may consolidateinformation mapping which MAC addresses (representative of hosts orvirtual machines) are associated with or known on which VNIs(representative of VL2 broadcast domains).

Turning to FIG. 20B, in Step 2020, based on the lookup (performed inStep 2010), a determination is made as to whether the VARP MAC addressis known on the forward-service VNI. In one embodiment of the invention,if it is determined that an entry in the MAC-to-VNI table maps the VARPMAC address to at least the forward-service VNI, then the VARP MACaddress is recognized as being known on the forward-service VNI.Accordingly, based on this determination, the process may proceed toStep 2022. On the other hand, in another embodiment of the invention, ifit is alternatively determined that an entry in the MAC-to-VNI tablefails to map the VARP MAC address to at least the forward-service VNI,then the VARP MAC address is recognized as being unknown on theforward-service VNI. Accordingly, based on this determination, theprocess may alternatively proceed to Step 2028.

In Step 2022, after determining (in Step 2020) that the VARP MAC addressis known on the forward-service VNI, a network interface out of whichthe unicast MAC frame may be transmitted, towards the first servicedevice, is identified. In one embodiment of the invention, theaforementioned network interface, entailing either a physical or virtualnetwork interface, may be identified through the performance of a lookupon a MAC address table using the VARP MAC address. The MAC address tablemay refer to a data structure that maintains one or more entries, whereeach entry not only specifies out which network interface to forwardnetwork traffic, but also through which overlay tunnel, if any, shouldthe network traffic be transmitted through in order to reach theirdesired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through the near network interface (NNI) ofthe first service VTEP. Accordingly, based on this determination, theunicast MAC frame may be directed to the NNI of the first service VTEP.

In Step 2024, the unicast MAC frame is subsequently translated into thefirst original VL2 broadcast domain. In one embodiment of the invention,this translation may transpire because of a service-specific trafficflow rule (TFR) (described above)—e.g., dictating the translation of anyegress network traffic (i.e., the unicast MAC frame) traversing the NNIof the first service VTEP from the forward-service VL2 broadcast domainto the first original VL2 broadcast domain. Furthermore, theaforementioned translation may entail replacing the forward-service VL2broadcast domain tag, specified in header information of the unicast MACframe, with a first original VL2 broadcast domain tag. The firstoriginal VL2 broadcast domain tag may include information thatidentifies the unicast MAC frame as being associated with the firstoriginal VL2 broadcast domain. The first original VL2 broadcast domaintag may include additional information without departing from the scopeof the invention. In Step 2026, after the translation (performed in Step2024), the unicast MAC frame is bridged across the NNI of the firstservice VTEP to a directly-connected first service device.

In Step 2028, after determining (in Step 2020) that the VARP MAC addressis unknown on the forward-service VNI, the unicast MAC frame is floodedto all destinations known on the forward-service VNI. Accordingly, acopy of the unicast MAC frame may find its way to the directly-connectedfirst service device via traversal of the NNI of the first service VTEP.

FIGS. 21A-21C show flowcharts describing a method for transmittinginspected unicast network traffic from a first zone to a second zone inaccordance with one or more embodiments of the invention. The varioussteps outlined below may be performed by a first service virtual tunnelend point (VTEP) (i.e., a VTEP directly-connected to a first servicedevice) residing within a first subnet or zone. Further, while thevarious steps in the flowcharts are presented and describedsequentially, one of ordinary skill will appreciate that some or allsteps may be executed in different orders, may be combined or omitted,and some or all steps may be executed in parallel.

Turning to FIG. 21A, in Step 2100, a unicast media access control (MAC)frame is received from a directly-connected first service device. In oneembodiment of the invention, the unicast MAC frame may arrive through afar network interface (FNI) (see e.g., FIG. 2) of the first serviceVTEP. Further, the unicast MAC frame may include or specify a firstoriginal virtual layer-2 (VL2) broadcast domain tag within its L2 headerinformation. The first original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith a first original VL2 broadcast domain. The first original VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In Step 2102, a unicast MAC frame copy is obtained through portmirroring. In one embodiment of the invention, port mirroring may referto the replication of network traffic seen on one network interface toyield a copy of that network traffic, which may then be directed toanother network interface. Furthermore, the port mirroring may transpirebecause of a service-specific network interface configuration (NIC)(described above)—e.g., dictating the configuration of a mirroringproperty (or attribute) belonging to the FNI of the first service VTEPsuch that the FNI mirrors any ingress network traffic at the FNI to theloop-start interface (LSI) (see e.g., FIG. 2) of the first service VTEP.Accordingly, in Step 2104, based on the aforementioned service-specificNIC, the unicast MAC frame copy (obtained in Step 2102) is directed tothe LSI of the first service VTEP.

In Step 2106, after the unicast MAC frame copy is directed to the LSI ofthe first service VTEP (in Step 2104), the unicast MAC frame copy isreceived at a loop-end interface (LEI) (see e.g., FIG. 2) of the firstservice VTEP. In one embodiment of the invention, the LSI and the LEImay be connected together using a physical loopback cable. Accordingly,any egress network traffic traversing the LSI becomes ingress networktraffic arriving at the LEI.

In Step 2108, the unicast MAC frame copy is translated into a firstreverse-service VL2 broadcast domain. In one embodiment of theinvention, this translation may transpire because of a service-specifictraffic flow rule (TFR) (described above)—e.g., dictating thetranslation of any ingress network traffic (i.e., the unicast MAC framecopy) traversing the LEI of the first service VTEP from the firstoriginal VL2 broadcast domain to the first reverse-service VL2 broadcastdomain. Furthermore, the aforementioned translation may entail replacingthe first original VL2 broadcast domain tag, specified in headerinformation of the unicast MAC frame copy, with a first reverse-serviceVL2 broadcast domain tag. The first reverse-service VL2 broadcast domaintag may include information that identifies the unicast MAC frame copyas being associated with a first reverse-service VL2 broadcast domain.The first reverse-service VL2 broadcast domain tag may includeadditional information without departing from the scope of theinvention.

Turning to FIG. 21B, in Step 2120, a lookup is performed on a firstreverse-service virtual network identifier (VNI) using VARP MAC addressspecified in header information of the unicast MAC frame copy. In oneembodiment of the invention, the first reverse-service VNI may identifywith a reverse-service VL2 broadcast domain. Further, the aforementionedlookup may entail searching through one or more entries in a MAC-to-VNItable for an entry that specifies at least the destination host (ordestination virtual machine) MAC address. The aforementioned MAC-to-VNItable may maintain one or more entries, where each entry may include orspecify one MAC address and one or more VNIs to which the one MACaddress is mapped. Therefore, in one embodiment of the invention, theMAC-to-VNI table may consolidate information mapping which MAC addresses(representative of hosts or virtual machines) are associated with orknown on which VNIs (representative of VL2 broadcast domains).

In Step 2122, based on the lookup (performed in Step 2120), it isdetermined that an entry in the MAC-to-VNI table fails to map the VARPMAC address to at least the first reverse-service VNI. Based on thisdetermination, the VARP MAC address is subsequently unknown on the firstreverse-service VNI. Accordingly, in Step 2124, the unicast MAC framecopy is dropped. This may be the case because, in one embodiment of theinvention, a service-specific network interface configuration (NIC)(described above) may have previously configured a flooding property (orattribute) belonging to the LEI of the service VTEP such that unknownunicast flooding at the LEI is disabled.

In Step 2126, returning to the unicast MAC frame (received at the FNI ofthe first service VTEP in Step 2100), the VARP MAC address, specified inheader information, is replaced with a remote service network elementMAC address (i.e., belonging to the network element on which a secondservice VTEP may be executing). Specifically, in one embodiment of theinvention, with L3 routing enabled, the first service VTEP may route theunicast MAC frame to a next-hop destination. Further, the next-hopdestination, based on a MAC address table, may be identified as thesecond service VTEP (i.e., a remote service VTEP servicing a second,remote subnet or zone).

In Step 2128, based on identifying that the next-hop destination of theunicast MAC frame lies on a different subnet/zone, the unicast MAC frameis translated into a second original VL2 broadcast domain. In oneembodiment of the invention, the second original VL2 broadcast domainmay represent the overlay tunnel through which network traffic musttraverse to reach the second service VTEP (residing in the second zone)from the first zone. Furthermore, the aforementioned translation mayentail replacing the first original VL2 broadcast domain tag, specifiedin header information of the unicast MAC frame, with a second originalVL2 broadcast domain tag. The second original VL2 broadcast domain tagmay include information that identifies the unicast MAC frame as beingassociated with the second original VL2 broadcast domain. The secondoriginal VL2 broadcast domain tag may include additional informationwithout departing from the scope of the invention.

In Step 2130, a lookup is performed on a second original VNI using thenext-hop destination MAC address (i.e., the second service networkelement MAC address) specified in header information of the unicast MACframe. In one embodiment of the invention, the second original VNI mayidentify with the second original VL2 broadcast domain. Moreover, in oneembodiment of the invention, the aforementioned lookup may entailsearching through one or more entries in a MAC-to-VNI table for an entrythat specifies at least the next-hop destination MAC address. Theaforementioned MAC-to-VNI table may maintain one or more entries, whereeach entry may include or specify one MAC address and one or more VNIsto which the one MAC address is mapped. Therefore, in one embodiment ofthe invention, the MAC-to-VNI table may consolidate information mappingwhich MAC addresses (representative of hosts or virtual machines) areassociated with or known on which VNIs (representative of VL2 broadcastdomains).

Turning to FIG. 21C, in Step 2140, based on the lookup (performed inStep 2130), a determination is made as to whether the next-hopdestination MAC address is known on the second original VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the next-hop destination MAC address to at leastthe second original VNI, then the next-hop destination MAC address isrecognized as being known on the second original VNI. Accordingly, basedon this determination, the process may proceed to Step 2142. On theother hand, in another embodiment of the invention, if it isalternatively determined that an entry in the MAC-to-VNI table fails tomap the next-hop destination MAC address to at least the second originalVNI, then the next-hop destination MAC address is recognized as beingunknown on the second original VNI. Accordingly, based on thisdetermination, the process may alternatively proceed to Step 2146.

In Step 2142, after determining (in Step 2140) that the next-hopdestination MAC address is known on the second original VNI, a networkinterface out of which the unicast MAC frame may be transmitted, towardsthe second service VTEP, is identified. In one embodiment of theinvention, the aforementioned network interface, entailing either aphysical or virtual network interface, may be identified through theperformance of a lookup on a MAC address table using the next-hopdestination MAC address.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through a certain network interface, whichleads to the second service VTEP, and using an overlay tunnel thatimplements the second original VL2 broadcast domain. Subsequently, theunicast MAC frame may be encapsulated in a virtual layer-3 (VL3) framesuch as, for example, a VXLAN frame, where the VL3 frame may includeheader information that specifies, at least in part, the second originalVNI.

In Step 2144, the VL3 frame (obtained in Step 2142) is transmitted,through an L3 fabric (see e.g., FIG. 1), towards the second serviceVTEP. Specifically, in one embodiment of the invention, the VL3 framemay traverse through an overlay tunnel—i.e., representative of thesecond original VL2 broadcast domain—that originates at the firstservice VTEP and, subsequently, terminates at the second service VTEP,behind which a second service device (i.e., the service device servicinga remote subnet or zone) resides.

In Step 2146, after determining (in Step 2140) that the next-hopdestination MAC address is unknown on the second original VNI, theunicast MAC frame is flooded to all destinations known on the secondoriginal VNI. Accordingly, a copy of the unicast MAC frame may find itsway to the second service VTEP.

FIGS. 22A and 22B show flowcharts describing a method for receivinginspected unicast network traffic within a second zone in accordancewith one or more embodiments of the invention. The various stepsoutlined below may be performed by a second service virtual tunnel endpoint (VTEP) (i.e., a VTEP directly-connected to a second servicedevice) residing within a second subnet or zone. Further, while thevarious steps in the flowcharts are presented and describedsequentially, one of ordinary skill will appreciate that some or allsteps may be executed in different orders, may be combined or omitted,and some or all steps may be executed in parallel.

Turning to FIG. 22A, in Step 2200, a virtual layer-3 (VL3) frame isreceived. In one embodiment of the invention, the VL3 frame may haveoriginated from a first service VTEP (residing within a first subnet orzone—i.e., a different subnet/zone within which the second service VTEPresides). Further, the VL3 frame may include or specify a secondoriginal virtual network identifier (VNI) within header information. Thesecond original VNI may identify with a second original virtual layer-2(VL2) broadcast domain.

In Step 2202, the VL3 frame (received in Step 2200) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a unicast media access control (MAC) frameenclosed therein. The unicast MAC frame may have originated from a firstremote, intercept host (or intercept virtual machine). Furthermore, theunicast MAC frame may include or specify a second original VL2 broadcastdomain tag (e.g., a second original virtual local area network (VLAN)tag). The second original VL2 broadcast domain tag may includeinformation that identifies the unicast MAC frame as being associatedwith a second original VL2 broadcast domain. The second original VL2broadcast domain tag may include additional information withoutdeparting from the scope of the invention.

In Step 2204, the next-hop destination MAC address (i.e., a secondservice network element MAC address), specified in header information,is replaced with a destination host (or destination virtual machine) MACaddress. Specifically, in one embodiment of the invention, thedestination host/virtual machine Internet Protocol (IP) address,specified in header information, may be resolved to identify thedestination host/virtual machine MAC address for the destinationhost/virtual machine residing within the second subnet or zone.

Turning to FIG. 22B, in Step 2220, a lookup is performed on the secondoriginal VNI using the destination host (or destination virtual machine)MAC address specified in header information of the unicast MAC frame. Inone embodiment of the invention, the second original VNI may identifywith the second original VL2 broadcast domain. Further, theaforementioned lookup may entail searching through one or more entriesin a MAC-to-VNI table for an entry that specifies at least thedestination host (or destination virtual machine) MAC address. Theaforementioned MAC-to-VNI table may maintain one or more entries, whereeach entry may include or specify one MAC address and one or more VNIsto which the one MAC address is mapped. Therefore, in one embodiment ofthe invention, the MAC-to-VNI table may consolidate information mappingwhich MAC addresses (representative of hosts or virtual machines) areassociated with or known on which VNIs (representative of VL2 broadcastdomains).

In Step 2222, based on the lookup (performed in Step 2220), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the second original VNI. In oneembodiment of the invention, if it is determined that an entry in theMAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the second original VNI, then thedestination host/virtual machine MAC address is recognized as beingknown on the second original VNI. Accordingly, based on thisdetermination, the process may proceed to Step 2224. On the other hand,in another embodiment of the invention, if it is alternativelydetermined that an entry in the MAC-to-VNI table fails to map thedestination host (or destination virtual machine) MAC address to atleast the second original VNI, then the destination host/virtual machineMAC address is recognized as being unknown on the second original VNI.Accordingly, based on this determination, the process may alternativelyproceed to Step 2228.

In Step 2224, after determining (in Step 2222) that the destination host(or destination virtual machine) MAC address is known on the secondoriginal VNI, a network interface out of which the unicast MAC frame maybe transmitted, towards a second service device, is identified. In oneembodiment of the invention, the aforementioned network interface,entailing either a physical or virtual network interface, may beidentified through the performance of a lookup on a MAC address tableusing the destination host (or destination virtual machine) MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through the far network interface (FNI) ofthe second service VTEP. Accordingly, based on this determination, theunicast MAC frame may be directed to the FNI of the second service VTEP.Thereafter, in Step 2226, the unicast MAC frame is subsequently bridgedacross the FNI of the second service VTEP to a directly-connected secondservice device.

In Step 2228, after determining (in Step 2222) that the destination host(or destination virtual machine) MAC address is unknown on the secondoriginal VNI, the unicast MAC frame is flooded to all destinations knownon the second original VNI. In one embodiment of the invention, throughMAC learning and/or the receipt of MAC programming instructions (MPIs)(described above), destinations known on the second original VNI mayinclude, but are not limited to: the FNI of the second service VTEP,behind which a second service device may reside. Accordingly, a copy ofthe unicast MAC frame may find its way to the directly-connected secondservice device via traversal of the FNI of the second service VTEP.

FIGS. 23A-23C show flowcharts describing a method for transmittinginspected unicast network traffic within a second zone in accordancewith one or more embodiments of the invention. The various stepsoutlined below may be performed by a second service virtual tunnel endpoint (VTEP) (i.e., a VTEP directly-connected to a second servicedevice) residing within a second subnet or zone. Further, while thevarious steps in the flowcharts are presented and describedsequentially, one of ordinary skill will appreciate that some or allsteps may be executed in different orders, may be combined or omitted,and some or all steps may be executed in parallel.

Turning to FIG. 23A, in Step 2300, a unicast media access control (MAC)frame is received from a directly-connected second service device. Inone embodiment of the invention, the unicast MAC frame may arrivethrough a near network interface (NNI) (see e.g., FIG. 2) of the secondservice VTEP. Further, the unicast MAC frame may include or specify asecond original virtual layer-2 (VL2) broadcast domain tag within its L2header information. The second original VL2 broadcast domain tag mayinclude information that identifies the unicast MAC frame as beingassociated with a second original VL2 broadcast domain. The secondoriginal VL2 broadcast domain tag may include additional informationwithout departing from the scope of the invention.

In Step 2302, the unicast MAC frame is translated into a secondreverse-service VL2 broadcast domain. In one embodiment of theinvention, this translation may transpire because of a service-specifictraffic flow rule (TFR) (described above)—e.g., dictating thetranslation of any egress network traffic (i.e., the unicast MAC frame)traversing the NNI of the second service VTEP from the second originalVL2 broadcast domain to the second reverse-service VL2 broadcast domain.Furthermore, the aforementioned translation may entail replacing thesecond original VL2 broadcast domain tag, specified in headerinformation of the unicast MAC frame, with a second reverse-service VL2broadcast domain tag. The second reverse-service VL2 broadcast domaintag may include information that identifies the unicast MAC frame asbeing associated with the second reverse-service VL2 broadcast domain.The second reverse-service VL2 broadcast domain tag may includeadditional information without departing from the scope of theinvention.

In Step 2304, a lookup is performed on a second reverse-service virtualnetwork identifier (VNI) using a destination host (or destinationvirtual machine) MAC address specified in header information of theunicast MAC frame. In one embodiment of the invention, the secondreverse-service VNI may identify with the reverse-service VL2 broadcastdomain.

In Step 2306, based on the lookup (performed in Step 2304), adetermination is made as to whether the destination host (or destinationvirtual machine) MAC address is known on the second reverse-service VNI.In one embodiment of the invention, if it is determined that an entry inthe MAC-to-VNI table maps the destination host (or destination virtualmachine) MAC address to at least the second reverse-service VNI, thenthe destination host/virtual machine MAC address is recognized as beingknown on the second reverse-service VNI. Accordingly, based on thisdetermination, the process may proceed to Step 2320 (see e.g., FIG.23B). On the other hand, in another embodiment of the invention, if itis alternatively determined that an entry in the MAC-to-VNI table failsto map the destination host (or destination virtual machine) MAC addressto at least the second reverse-service VNI, then the destinationhost/virtual machine MAC address is recognized as being unknown on thesecond reverse-service VNI. Accordingly, based on this determination,the process may alternatively proceed to Step 2340 (see e.g., FIG. 23C).

Turning to FIG. 23B, in Step 2320, after determining (in Step 2306) thatthe destination host (or destination virtual machine) MAC address isknown on the second reverse-service VNI, another determination is madeas to whether the destination host/virtual machine isdirectly-connected. In one embodiment of the invention, identifyingwhether the destination host/virtual machine is directly-connected mayentail performing a lookup on a MAC address table using the destinationhost/virtual machine MAC address specified in header information of theunicast MAC frame. In one embodiment of the invention, if it isdetermined, based on the aforementioned lookup on the MAC address table,that the destination host/virtual machine is directly-connected, theprocess may proceed to Step 2322. On the other hand, in anotherembodiment of the invention, if it is alternatively determined, based onthe lookup, that the destination host/virtual machine is notdirectly-connected (i.e., indicative of a remote destination), theprocess may alternatively proceed to Step 2326.

In Step 2322, after determining (in Step 2320) that the destination host(or destination virtual machine) is directly-connected, the unicast MACframe is translated into the second original VL2 broadcast domain. Inone embodiment of the invention, this translation may transpire becauseof an intercept-specific traffic flow rule (TFR) (described above)—e.g.,dictating the translation of any egress network traffic (i.e., theunicast MAC frame copy) traversing an intercept network interface (INI)of an intercept VTEP (i.e., which the second service VTEP also is inthis case) from the second reverse-service VL2 broadcast domain to thesecond original VL2 broadcast domain. Furthermore, the aforementionedtranslation may entail replacing the second reverse-service VL2broadcast domain tag, specified in header information of the unicast MACframe, with a second original VL2 broadcast domain tag. The secondoriginal VL2 broadcast domain tag may include information thatidentifies the unicast MAC frame as being associated with the secondoriginal VL2 broadcast domain. The second original VL2 broadcast domaintag may include additional information without departing from the scopeof the invention. Thereafter, in Step 2324, the unicast MAC frame isbridged across an INI of the second service (intercept) VTEP to thedirectly-connected destination host (or destination virtual machine).

In Step 2326, after determining (in Step 2320) that the destination host(or destination virtual machine) is not directly-connected, an entry inthe MAC address table may specify that the unicast MAC frame should betransmitted through a certain network interface, leading to a secondremote VTEP, and using an overlay tunnel that implements the secondreverse-service VL2 broadcast domain. Subsequently, the unicast MACframe may be encapsulated in a VL3 frame such as, for example, a VXLANframe, where the VL3 frame may include header information thatspecifies, at least in part, the second reverse-service VNI.

In Step 2328, the VL3 frame (obtained in Step 2326) is transmitted,through an L3 fabric (see e.g., FIG. 1), towards the second remote VTEP.Specifically, in one embodiment of the invention, the VL3 frame maytraverse through an overlay tunnel—i.e., representative of the secondreverse-service VL2 broadcast domain—that originates at the secondservice VTEP and, subsequently, terminates at the second remote VTEP,behind which the destination host/virtual machine resides.

Turning to FIG. 23C, in Step 2340, after determining (in Step 2306) thatthe destination host (or destination virtual machine) is unknown on thesecond reverse-service VNI, the unicast MAC frame is flooded to alldestinations known on the second reverse-service VNI. In one embodimentof the invention, through MAC learning and/or the receipt of MACprogramming instructions (MPIs) (described above), destinations known onthe second reverse-service VNI may include, but are not limited to: atleast one intercept network interface (INI) (see e.g., FIG. 2) of one ormore intercept VTEPs, behind which at least one intercept host (orintercept virtual machine) may reside. Accordingly, a copy of theunicast MAC frame may find its way to the destination host/virtualmachine, which may or may be directly-connected.

FIGS. 24A-24C show flowcharts describing a method for deliveringinspected unicast network traffic within a second zone in accordancewith one or more embodiments of the invention. The various stepsoutlined below may be performed by a second non-service virtual tunnelend point (VTEP) (i.e., a VTEP not directly-connected to a secondservice device (or a second remote VTEP)) residing within a secondsubnet or zone. Further, while the various steps in the flowcharts arepresented and described sequentially, one of ordinary skill willappreciate that some or all steps may be executed in different orders,may be combined or omitted, and some or all steps may be executed inparallel.

Turning to FIG. 24A, in Step 2400, a virtual layer-3 (VL3) frame isreceived. In one embodiment of the invention, the VL3 frame may haveoriginated from a second service VTEP. Further, the VL3 frame mayinclude or specify a second reverse-service virtual network identifier(VNI) within header information. The second reverse-service VNI mayidentify with a second reverse-service virtual layer-2 (VL2) broadcastdomain.

In Step 2402, the VL3 frame (received in Step 2400) is decapsulated.Specifically, in one embodiment of the invention, decapsulation mayentail removing the L3 header information included or specified in theVL3 frame, thereby exposing a unicast media access control (MAC) frameenclosed therein. The unicast MAC frame may have originated from aremote, intercept source host (or non-intercept source virtual machine)that resides in a different (i.e., the first) subnet or zone. Theunicast MAC frame may also be addressed to an intercept destination host(or intercept virtual machine) within the second subnet/zone.Furthermore, the unicast MAC frame may include or specify a secondreverse-service VL2 broadcast domain tag (e.g., a second reverse-servicevirtual local area network (VLAN) tag). The second reverse-service VL2broadcast domain tag may include information that identifies the unicastMAC frame as being associated with the second reverse-service VL2broadcast domain. The second reverse-service VL2 broadcast domain tagmay include additional information without departing from the scope ofthe invention.

In Step 2404, a lookup is performed on the second reverse-service VNIusing the intercept destination host (or intercept destination virtualmachine) MAC address specified in header information of the unicast MACframe. In one embodiment of the invention, the aforementioned lookup mayentail searching through one or more entries in a MAC-to-VNI table foran entry that specifies at least the intercept destination host (orintercept destination virtual machine) MAC address. The aforementionedMAC-to-VNI table may maintain one or more entries, where each entry mayinclude or specify one MAC address and one or more VNIs to which the oneMAC address is mapped. Therefore, in one embodiment of the invention,the MAC-to-VNI table may consolidate information mapping which MACaddresses (representative of hosts or virtual machines) are associatedwith or known on which VNIs (representative of VL2 broadcast domains).

In Step 2406, based on the lookup (performed in Step 2404), adetermination is made as to whether the intercept destination host (orintercept destination virtual machine) MAC address is known on thesecond reverse-service VNI. In one embodiment of the invention, if it isdetermined that an entry in the MAC-to-VNI table maps the interceptdestination host (or intercept destination virtual machine) MAC addressto at least the second reverse-service VNI, then the interceptdestination host/virtual machine MAC address is recognized as beingknown on the second reverse-service VNI. Accordingly, based on thisdetermination, the process may proceed to Step 2420 (see e.g., FIG.24B). On the other hand, in another embodiment of the invention, if itis alternatively determined that an entry in the MAC-to-VNI table failsto map the intercept destination host (or intercept destination virtualmachine) MAC address to at least the second reverse-service VNI, thenthe intercept destination host/virtual machine MAC address is recognizedas being unknown on the second reverse-service VNI. Accordingly, basedon this determination, the process may alternatively proceed to Step2440 (see e.g., FIG. 24C).

Turning to FIG. 24B, in Step 2420, after determining (in Step 2406) thatthe destination host (or destination virtual machine) MAC address isknown on the second reverse-service VNI, a network interface out ofwhich the unicast MAC frame may be transmitted, towards the interceptdestination host/virtual machine, is identified. In one embodiment ofthe invention, the aforementioned network interface, entailing either aphysical or virtual network interface, may be identified through theperformance of a lookup on a MAC address table using the interceptdestination host (or intercept destination virtual machine) MAC address.The MAC address table may refer to a data structure that maintains oneor more entries, where each entry not only specifies out which networkinterface to forward network traffic, but also through which overlaytunnel, if any, should the network traffic be transmitted through inorder to reach their desired destination or a next hop along the way.

In one embodiment of the invention, based on the above-mentioned lookupon the MAC address table, it may be determined that the unicast MACframe should be transmitted through an intercept network interface (INI)(see e.g., FIG. 2) of the second non-service (remote) VTEP. Accordingly,based on this determination, the unicast MAC frame may be directed tothe identified INI of the second non-service (remote) VTEP.

In Step 2422, the unicast MAC frame is translated into the secondoriginal VL2 broadcast domain. In one embodiment of the invention, thistranslation may transpire because of an intercept-specific traffic flowrule (TFR) (described above)—e.g., dictating the translation of anyegress network traffic (i.e., the unicast MAC frame) traversing anintercept network interface (INI) of an intercept VTEP (i.e., the secondnon-service (remote) VTEP) from the second reverse-service VL2 broadcastdomain to the second original VL2 broadcast domain. Furthermore, theaforementioned translation may entail replacing the secondreverse-service VL2 broadcast domain tag, specified in headerinformation of the unicast MAC frame, with a second original VL2broadcast domain tag. The second original VL2 broadcast domain tag mayinclude information that identifies the unicast MAC frame as beingassociated with the second original VL2 broadcast domain. The secondoriginal VL2 broadcast domain tag may include additional informationwithout departing from the scope of the invention. Thereafter, in Step2424, the unicast MAC frame is bridged across the identified INI of thesecond non-service (remote) VTEP to the directly-connected interceptdestination host (or intercept destination virtual machine).

Turning to FIG. 24C, in Step 2440, after determining (in Step 2406) thatthe intercept destination host (or intercept destination virtualmachine) MAC address is unknown on the second reverse-service VNI, theunicast MAC frame is flooded to all destinations known on the secondreverse-service VNI. In one embodiment of the invention, through MAClearning and/or the receipt of MAC programming instructions (MPIs)(described above), destinations known on the second reverse-service VNImay include, but are not limited to: any and all INIs of the secondnon-service (remote) VTEP, behind which at least one intercept host (orintercept virtual machine) may reside. Accordingly, a copy of theunicast MAC frame may find its way to the directly-connected interceptdestination host/virtual machine via traversal of the identified INI ofthe second non-service (remote) VTEP.

While the invention has been described with respect to a limited numberof embodiments, those skilled in the art, having benefit of thisdisclosure, will appreciate that other embodiments can be devised whichdo not depart from the scope of the invention as disclosed herein.Accordingly, the scope of the invention should be limited only by theattached claims.

What is claimed is:
 1. A method for processing network traffic,comprising: receiving, from a first remote virtual tunnel end point(VTEP), a first virtual layer-3 (VL3) frame comprising a forward-servicevirtual network identifier (VNI); decapsulating the first VL3 frame toobtain a first unicast media access control (MAC) frame originating froma first source, wherein the first unicast MAC frame comprises aforward-service virtual layer-2 (VL2) broadcast domain tag associatedwith a forward-service VL2 broadcast domain; making a firstdetermination, using a first destination MAC address associated with afirst destination, that the first destination MAC address is known onthe forward-service VNI; translating, based on the first determination,the first unicast MAC frame into an original VL2 broadcast domain, toobtain a second unicast MAC frame; and bridging, through a near networkinterface (NNI), the second unicast MAC frame to a service device. 2.The method of claim 1, wherein the first source is an intercept host oran intercept virtual machine.
 3. The method of claim 1, wherein thefirst VL3 frame is a virtual extensible local area network (VXLAN)frame.
 4. The method of claim 1, further comprising: receiving, from theservice device through a far network interface (FNI) and after theservice device performs a service function, the second unicast MACframe; making a second determination, using the first destination MACaddress, that the first destination MAC address is known on an originalVNI; making a third determination, based at least on redirect criteriaand the second determination, that the first destination is an intercepthost or an intercept virtual machine; and dropping, based on the thirddetermination, the second unicast MAC frame.
 5. The method of claim 1,further comprising: receiving, from the service device through a farnetwork interface (FNI) and after the service device performs a servicefunction, the second unicast MAC frame; making a second determination,using the first destination MAC address, that the first destination MACaddress is known on an original VNI; and making a third determination,based at least on redirect criteria and the second determination, thatthe first destination is a non-intercept host or a non-intercept virtualmachine.
 6. The method of claim 5, further comprising: making a fourthdetermination, based on the third determination, that the firstdestination is directly-connected; and bridging, based on the fourthdetermination, the second unicast MAC frame to the first destination. 7.The method of claim 5, further comprising: making a fourthdetermination, based on the third determination, that the firstdestination is not directly-connected; encapsulating, based on thefourth determination, the second unicast MAC frame in a second VL3 framecomprising the original VNI; and transmitting the second VL3 frametowards a second remote VTEP, wherein the first destination residesbehind the second remote VTEP.
 8. The method of claim 1, furthercomprising: receiving, from the service device through a far networkinterface (FNI) and after the service device performs a servicefunction, the second unicast MAC frame; mirroring the second unicast MACframe to obtain a first unicast MAC frame copy; transmitting the firstunicast MAC frame copy through a loop-start interface (LSI); receivingthe first unicast MAC frame copy through a loop-end interface (LEI),wherein the LEI is connected to the LSI; and translating the firstunicast MAC frame copy into a reverse-service VL2 broadcast domain, toobtain a second unicast MAC frame copy.
 9. The method of claim 8,further comprising: making a second determination, using the firstdestination MAC address, that the first destination MAC address is knownon a reverse-service VNI; making a third determination, based on thesecond determination, that the first destination is directly-connected;translating, based on the third determination, the second unicast MACframe copy into the original VL2 broadcast domain; and bridging, afterthe translating, the second unicast MAC frame copy to the firstdestination.
 10. The method of claim 8, further comprising: making asecond determination, using the first destination MAC address, that thefirst destination MAC address is known on a reverse-service VNI; makinga third determination, based on the second determination, that the firstdestination is not directly-connected; encapsulating, based on the thirddetermination, the second unicast MAC frame copy in a second VL3 framecomprising the reverse-service VNI; and transmitting the second VL3frame towards a second remote VTEP, wherein the first destinationresides behind the second remote VTEP.
 11. The method of claim 8,further comprising: making a second determination, using the firstdestination MAC address, that the first destination MAC address isunknown on a reverse-service VNI; and dropping, based on the seconddetermination, the second unicast MAC frame copy.
 12. The method ofclaim 1, further comprising: receiving, from the first remote VTEP, asecond VL3 frame comprising an original VNI; decapsulating the secondVL3 frame to obtain a third unicast MAC frame originating from a secondsource, wherein the third unicast MAC frame comprises an original VL2broadcast domain tag associated with the original VL2 broadcast domain;making a second determination, using a second destination MAC addressassociated with a second destination, that the second destination MACaddress is known on the original VNI; and bridging, based on the seconddetermination, the third unicast MAC frame to the service device througha far network interface (FNI).
 13. The method of claim 12, furthercomprising: receiving, from the service device through the NNI and afterthe service device performs a service function, the third unicast MACframe; translating the third unicast MAC frame into a reverse-serviceVL2 broadcast domain, to obtain a fourth unicast MAC frame; and making athird determination, using the second destination MAC address, that thesecond destination MAC address is known on a reverse-service VNI. 14.The method of claim 13, further comprising: making a fourthdetermination, based on the third determination, that the seconddestination is directly-connected; translating, based on the fourthdetermination, the fourth unicast MAC frame into the original VL2broadcast domain, to obtain a fifth unicast MAC frame; and bridging thefifth unicast MAC frame to the second destination.
 15. The method ofclaim 13, further comprising: making a fourth determination, based onthe third determination, that the second destination is notdirectly-connected; encapsulating, based on the fourth determination,the fourth unicast MAC frame in a third VL3 frame comprising thereverse-service VNI; and transmitting the third VL3 frame towards asecond remote VTEP, wherein the second destination resides behind thesecond remote VTEP.
 16. A non-transitory computer readable medium (CRM)comprising computer readable program code, which when executed by acomputer processor, enables the computer processor to: receive, from afirst remote virtual tunnel end point (VTEP), a first virtual layer-3(VL3) frame comprising a forward-service virtual network identifier(VNI); decapsulate the first VL3 frame to obtain a first unicast mediaaccess control (MAC) frame originating from a first source, wherein thefirst unicast MAC frame comprises a forward-service virtual layer-2(VL2) broadcast domain tag associated with a forward-service VL2broadcast domain; make a first determination, using a first destinationMAC address associated with a first destination, that the firstdestination MAC address is known on the forward-service VNI; translate,based on the first determination, the first unicast MAC frame into anoriginal VL2 broadcast domain, to obtain a second unicast MAC frame; andbridge, through a near network interface (NNI), the second unicast MACframe to a service device.
 17. The non-transitory CRM of claim 16,wherein the first source is an intercept host or an intercept virtualmachine.
 18. The non-transitory CRM of claim 16, wherein the first VL3frame is a virtual extensible local area network (VXLAN) frame.
 19. Thenon-transitory CRM of claim 16, further comprising computer readableprogram code, which when executed by the computer processor, enables thecomputer processor to: receive, from the service device through a farnetwork interface (FNI) and after the service device performs a servicefunction, the second unicast MAC frame; make a second determination,using the first destination MAC address, that the first destination MACaddress is known on an original VNI; make a third determination, basedat least on redirect criteria and the second determination, that thefirst destination is an intercept host or an intercept virtual machine;and drop, based on the third determination, the second unicast MACframe.
 20. The non-transitory CRM of claim 16, further comprisingcomputer readable program code, which when executed by the computerprocessor, enables the computer processor to: receive, from the firstremote VTEP, a second VL3 frame comprising an original VNI; decapsulatethe second VL3 frame to obtain a third unicast MAC frame originatingfrom a second source, wherein the third unicast MAC frame comprises anoriginal VL2 broadcast domain tag associated with the original VL2broadcast domain; make a second determination, using a seconddestination MAC address associated with a second destination, that thesecond destination MAC address is known on the original VNI; and bridge,based on the second determination, the third unicast MAC frame to theservice device through a far network interface (FNI).